- cypherpunks - lists.cpunks.org

Re: [Cryptography] Best internet crypto clock: hmmmmm...
by Lodewijk andré de la porte 01 Nov '14

01 Nov '14

2014-11-01 22:48 GMT+01:00 Tom Mitchell <mitch(a)niftyegg.com>: > On Fri, Oct 31, 2014 at 11:51 PM, grarpamp <grarpamp(a)gmail.com> wrote: > >> On Fri, Oct 31, 2014 at 2:57 PM, Dave Horsfall <dave(a)horsfall.org> wrote: >> > On Fri, 31 Oct 2014, Harald Hanche-Olsen wrote: >> > >> >> Are you perhaps thinking of the so-called EURion constellation? >> > ... > >> http://www.secretservice.gov/know_your_money.shtml >> >> Quality counterfeiters of US notes don't care what > > > One of the driving forces to the changes in currency around > the globe was angst and some evidence of nation level > counterfeiting. Some small number of folk still have first > hand knowledge of currency attacks in WW2 and how effective > (or not) these attacks were. Good accounts are sparse and > like other secrets seem to still be closely held. > > I know that the local farmers market and flea market vendors in > this area are very cautious about $20 bills that are apparently > color printer and color copier produced. > > I did see some mumble about N. Korea and very high > end intaglio printing about the same time the US and other > nations started changing methods and designs. A secretive > well funded organization or government can do a lot to > produce counterfeit money. A decade or two earlier a lot of > effort was spent on durability. > I was about to mumble a tune about SuperDollars and ww2 currency devaluation attacks! They never really worked, or turned feasible, because delivery is quite hard and printing currency is quite expensive. It goes without saying that the secret service can use OCR > readers in multiple locations and track each and every printed > bill. If their audits detect an interesting level I can see the next > revision of design getting released into the cycle and aggressive > audited shredder action for the previous. > They hopefully do. But this is a crypto forum, right? So we can do better than just making hard-to-produce bills. We can produce an actual signature scheme! Using any crypto-currency but accepting double spends until an online check with central authority (blockchain is just a slow and decentralized central authority) can be done is probably really quite good. Optionally TPM's can put the central authority in your pocket, or in your bill! Too bad government sucks at technology.

1 0

Re: https://facebookcorewwwi.onion/
by Ryan Carboni 01 Nov '14

01 Nov '14

It probably will cost $1 billion to brute force an 80-bit address in a year. What website is actually worth that much? Not even impersonating facebook is worth that much, if you limit the value of the Tor address to the value of the Tor connections to it. The total value of the Tor network is probably no where near $10 billion (mostly CP and darknets though).

1 0

Fwd: [tor-talk] Cloak Tor Router
by coderman 01 Nov '14

01 Nov '14

---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Sat, 1 Nov 2014 12:42:41 -0700 Subject: Re: [tor-talk] Cloak Tor Router On 11/1/14, Lars Boegild Thomsen <lth(a)reclaim-your-privacy.com> wrote: > ... We - the team behind Cloak - and me (the > networking and embedded Linux guy in the team) are genuinely concerned about > privacy and we really would like this product to ... first question, did you contact Tor Project Inc. about this for their input? (if yes, what was their take on your aims?) > The first step was to isolate the Tor/Cloak related stuff from my internal > source tree and actually put a builtable source online on Github. That is > currently available here: https://github.com/ReclaimYourPrivacy. the majority of these repositories are forks of existing public projects, but not clearly so. (e.g. cloak-routing is a selection of specific OpenWRT packages, eschalot, etc.) what do you think of branching from upstream repositories, and keeping your changes in a manner that upstream would be encouraged to incorporate? i have more feedback on code itself, but this is foremost to mention. > Second step was to document the hardware development to convince everybody > (hopefully) that we _are_ actually capable of having a device such as this > manufactured at a competitive price. Most of that documentation went on our > web-site (https://reclaim-your-privacy.com) and schematics/PCB design on > Github (same url as before). i approve of open hardware approach very much :) perhaps useful to identify what is open (like PCB) and what is not (Atheros) > I had already (9 month back) come up with some sensible firewall rules that > would pretty much force all TCP traffic through Tor and since I had been > running it for 9 month it was at that time fairly well tested obviously this is not difficult, but it is also more complicated than just "some sensible rules". e.g. https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy and iptables -A OUTPUT -m conntrack --ctstate INVALID -j DROP and all the other intricacies... > ... at that time we > could generate a random root password and WiFi key, flash that to a small > dedicated R/O partition on the flash, print it on a label attached to the > box (along with Serial number and MAC address). it would also be great if you could introduce some per-device unique entropy seed, obtained from a strong hardware based random number generator. (how better to signal your interest in utmost privacy, even if practical benefit is less concrete? :) > First of all, I would like to hear more opinions about the value of a device > such as this. the concept of a portable Tor proxy hardware router that fits in your pocket is great, in my not so unbiased opinion :) > I realize that most technically adept people will frown on a a > "toy" such as the Cloak, what technical people will frown on is the way the device is presented to users, and if users are placed into risk by technical errors. > but this device is really not meant for anybody who > can install the Tor software on their own or someone who can install Tor on > a Rasberry Pi. that's fine; i believe it is possible to make a device that is transparently usable that also doesn't put users at needless risk, if that is what you are getting at. the suggestions others have made that i second: - block accidental Tor over Tor setups. - provide a Tor Browser on the supported platforms with TOR_TRANSPROXY=1 - provide automated builds, so that users can keep their device up to date easily, or use a built-in mechanism to obtain and install the latest easily. in general, some guidelines that me as a technical person would like to see: - the device should fail safe, rather than fail open: if i accidentally connect my friend's windows XP laptop to your device, it should block rather than allow all by default. - support robust stream isolation, beyond what may be default. perhaps IsolateDestAddr and IsolateByClientAddr on TransPort (this does not yet exist, but you could code it to the benefit of all Transparent proxy consumers :) --- regarding your other information: from your kickstarter, "We commit to establish and operate new exit nodes, to ensure that we are pulling our weight. Tor is currently at approx 2000 users per exit node. For every 1000 devices we ship, we will establish a new dedicated exit node. " why the focus on number of exit nodes, instead of contributed exit capacity? you're measuring the wrong thing here. --- i have more feedback, but your responses to these questions will help me determine how much time i can contribute to an evaluation. best regards,

1 0

Re: https://facebookcorewwwi.onion/
by Seth 01 Nov '14

01 Nov '14

On Fri, 31 Oct 2014 07:58:18 -0700, rysiek <rysiek(a)hackerspace.pl> wrote: > Apart from being torn about the move (good on Facebook to support TOR, > but I don't really feel like praising Facebook for anything I guess), > there I see two positive elements to this. 1) Potential massive increase in cover traffic for all Tor users 2) Competitive pressure on other 'social' network services to enable Tor .onion access -- Seth I <3 nicely trimmed email replies

1 0

Re: [tor-talk] Facebook brute forcing hidden services
by grarpamp 01 Nov '14

01 Nov '14

I would never use this unless you were actually censored from accessing facebook via clearnet. All it will do is serve to officially tell facebook that you are a tor user that FB can then further discriminate against as a class in the future once they start to lock down clearnet against exit nodes, travelers, etc or whatever their scheme is or will be. Remember, FB's official policy is still: - Real Names required - Phone Numbers / ID required - DOB required - Gender required - Email required - Etc required - Users are the product that is being mined and sold and shared. Such non optional elements, and choices, powers and rights removed from the user, are in direct opposition to the principles of Tor and anonymity. Normally support for onion/i2p is good thing, but when still backed by crap like this it's largely meaningless. https://news.ycombinator.com/item?id=8538281 http://yro.slashdot.org/story/14/10/31/1545231/facebook-sets-up-shop-on-tor http://www.reddit.com/r/onions/comments/2kvnbw/facebook_accessible_by_onion… http://www.reddit.com/r/TOR/comments/2kvl8r/facebook_now_officially_availab… [Some posters already seem to be getting locked out for using onion but of course cannot truly know why because FB does not state their metrics.]

2 1

Re: [Cryptography] Best internet crypto clock: hmmmmm...
by grarpamp 01 Nov '14

01 Nov '14

On Fri, Oct 31, 2014 at 2:57 PM, Dave Horsfall <dave(a)horsfall.org> wrote: > On Fri, 31 Oct 2014, Harald Hanche-Olsen wrote: > >> Are you perhaps thinking of the so-called EURion constellation? >> >> https://en.wikipedia.org/wiki/EURion_constellation > > That *could* be it; I'd heard a few different versions of the story that > some copiers would not do currency, and naturally the banks themselves are > going to be less than forthcoming about their techniques (just like in the > crypto world). http://www.secretservice.gov/know_your_money.shtml Quality counterfeiters of US notes don't care what BEP/FED/TREAS discloses, they just reverse engineer the bills. Also note that bills before 1990 have nearly trivial security and are still legal tender. There is a model year vs. timespan "ain't seen one of those lately" acceptance risk with older bills but that's about it. Either way, don't worry, your average gov't deflates bill value by printing, more than any counterfeit factory ever would want to. Note that paper money can be cloned with far less cost than any known attack on say Bitcoin, and with more profit since you still have the bills, but unless you can steal a tiny percent of the coins quietly all you'd do is bring the network trust to zero.

1 0

Fwd: [Cryptography] EFF, ACLU to Present Oral Argument in NSA Spying Case on Nov. 4
by grarpamp 01 Nov '14

01 Nov '14

---------- Forwarded message ---------- From: John Gilmore <gnu(a)toad.com> Date: Fri, Oct 31, 2014 at 2:40 PM Subject: [Cryptography] EFF, ACLU to Present Oral Argument in NSA Spying Case on Nov. 4 To: cryptography(a)metzdowd.com, gnu(a)toad.com Cryptography followers are invited to attend this court hearing in Washington, DC on November 4, opposing NSA's mass collection of telephone records. Observe government lawyers using twisted arguments and new meanings of simple words to justify spooky outrageous behavior! Support civil rights attorneys using principled arguments rooted in constitutional and societal norms to defend YOUR rights! Perceive the wheels of justice or just-us grinding the constitution into effect or into irrelevance! Show the judges and the press that the public cares whether NSA gets away with using totalitarian methods! See the constitutional issues around mass surveillance actually be discussed in an open, public court that actually hears from someone other than the government! The good guys won this case at the district court (the judge declared the NSA's actions unconstitutional), and the government had to appeal it to stop the ruling from killing off the program. This case could be very interesting, and these judges could make the final decision if the Supreme Court decides not to review their decision. Please be respectful, wear a costume (banker or politician duds suggested), and arrive without contraband, weapons, penknives, cameras, nor most other tools for resisting official oppression. Bring either a lawyer (who can sign you in) or bring unconstitutionally required identifying documents, or the US Marshals at the door will not admit you to this "public trial". I won't be there (wrong coast), but perhaps a DC local will organize a nearby place to have lunch afterward and discuss the hearing. John Gilmore Electronic Frontier Foundation Media Release For Immediate Release: Friday, October 31, 2014 Contact: Dave Maass Media Relations Coordinator Electronic Frontier Foundation press(a)eff.org +1 415 436-9333 x177 Media Alert: EFF, ACLU to Present Oral Argument in NSA Spying Case on Nov. 4 Court Should Rule That Mass Telephone Records Collection Is Unconstitutional in Klayman v. Obama Washington, D.C. - The Electronic Frontier Foundation (EFF) will appear before a federal appeals court next week to argue the National Security Agency (NSA) should be barred from its mass collection of telephone records of million of Americans. The hearing in Klayman v. Obama is set for 9:30 am on Tuesday, Nov. 4 in Washington, D.C. Appearing as an amicus, EFF Legal Director Cindy Cohn will present oral argument at the U.S. Court of Appeals for the District of Columbia Circuit on behalf of EFF and the American Civil Liberties Union (ACLU), which submitted a joint brief in the case. Conservative activist and lawyer Larry Klayman filed the suit in the aftermath of the first Edward Snowden disclosure, in which The Guardian revealed how the NSA was collecting telephone records on a massive scale from the telecommunications company Verizon. In December, District Court Judge Richard Leon issued a preliminary injunction in the case, declaring that the mass surveillance program was likely unconstitutional. EFF argues that the call-records collection, which the NSA conducts with claimed authority under Section 215 of the USA PATRIOT Act, violates the Fourth Amendment rights of millions of Americans. Separately, EFF is counsel in two other lawsuits against the program -- Jewel v. NSA and First Unitarian Church of Los Angeles v. NSA -- and is co-counsel with the ACLU in a third, Smith v. Obama. What: Oral Argument in Klayman v. Obama Who: EFF Legal Director Cindy Cohn When: 9:30 am (ET), Nov. 4, 2014 Where: E. Barrett Prettyman U.S. Courthouse and William B. Bryant Annex Courtroom 20 333 Constitution Ave., NW Washington, D.C. 20001 For background and legal documents: https://www.eff.org/cases/klayman-v-obama The audio of the oral arguments is expected to be available on the court's website sometime after the hearing: http://www.cadc.uscourts.gov/recordings/recordings.nsf/ For this release: https://www.eff.org/press/releases/media-alert-eff-aclu-present-oral-argume… About EFF The Electronic Frontier Foundation is the leading organization protecting civil liberties in the digital world. Founded in 1990, we defend free speech online, fight illegal surveillance, promote the rights of digital innovators, and work to ensure that the rights and freedoms we enjoy are enhanced, rather than eroded, as our use of technology grows. EFF is a member-supported organization. Find out more at https://www.eff.org. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

FBI demands new powers to hack into computers and carry out surveillance
by Ryan Carboni 30 Oct '14

30 Oct '14

http://www.theguardian.com/us-news/2014/oct/29/fbi-powers-hacking-computers… " The FBI <http://www.theguardian.com/us-news/fbi> is attempting to persuade an obscure regulatory body in Washington to change its rules of engagement in order to seize significant new powers to hack into and carry out surveillance of computers throughout the US and around the world. Civil liberties groups warn that the proposed rule change amounts to a power grab by the agency that would ride roughshod over strict limits to searches and seizures laid out under the fourth amendment of the US constitution, as well as violate first amendment privacy rights. They have protested that the FBI is seeking to transform its cyber capabilities with minimal public debate and with no congressional oversight."

4 4

Of Sealand, corp, and country [was: nation-state]
by grarpamp 29 Oct '14

29 Oct '14

On Sun, Oct 19, 2014 at 5:43 PM, Alfie John <alfiej(a)fastmail.fm> wrote: > On Thu, Oct 16, 2014, at 08:32 PM, rysiek wrote: >> I am waiting for the first multinational corporation to declare >> independence. >> Also: http://rys.io/en/77 > > Although not a multinational, The Pirate Bay did try to buy Sealand. Sealand is only as unique as the price Bates wants (it's also probably structurally unsound after taking an ocean beating for 70yrs)... How much would it cost to build, float and sink your own concrete silo? Who's researching locations of low depth found beyond 3-12+nm/EEZ in international waters? How does this cost compare to building your own acres of floating pontoon, barge, boat, or raft? And who sayeth hoisting your flag does not make you a country be?

2 3

Re: CITIZENFOUR (of Pole Dancer Girlfriends etc.)
by Steve Kinney 28 Oct '14

28 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/27/2014 05:14 PM, Andy Isaacson wrote: > On Sat, Oct 25, 2014 at 09:59:35PM -0400, Steve Kinney wrote: > >> In my mind the sudden appearance of that momentarily >> almost-famous "pole dancer girlfriend" of Snowden's is of a >> piece with the rest of The Snowden Affair: It raises more >> questions than it answers, and adds more reasons to suspect >> a double game. > > Whut. This, for starters: http://globalresearch.ca/nsa-deception-operation-questions-surround-leaked-… Questions raised by anomalies and inconsistencies present in the original reports of The Snowden Affair and the PRISM documents have not been resolved. > You know, the people who are involved in these stories are > actually humans, with real lives, families, and friendships. If > you watched CITIZENFOUR without realizing that, I am terribly > sorry for your inability to releate to others on a human level, > and I'd recommend that you talk to someone with a more > mainstream level of emotional intelligence about these issues. We have not physically met any of the players in this game; all we have to go on is propaganda, that is, stories created for the purpose of persuading us to adopt certain beliefs and perspectives. Propaganda is not necessarily a bad thing, nor does it always indicate deception: But to take the story presented at face value and proceed as if one has positive knowledge of the events depicted is at best a hazardous approach: Particularly when a story originates inside agencies whose stock in trade includes deception and manipulation of friend and foe as routine daily missions. My take on The Snowden Affair is deliberately contrarian. Every press outlet in the world takes the story at face value and questions nothing about its basic premises; the only permissible disagreement is whether one should be "for or against" Ed Snowden. Jumping on either bandwagon contributes nothing. In this situation, the more inconvenient a question is to the basic premise of the story, the more valuable it may be to our understanding of the substance and meaning of the story. > While Snowden is the object of significant official pressure, > the rule of law is still respected at least occasionally in > the USA, and Lindsay is not accused of any crimes. There's no > reason to suppose that she would be prevented by USG from > traveling, and any such restriction would be front-page news. > (I'm not disputing that surreptitious tracking of her and > others is quite likely to be occurring, of course!) > > Your insinuation that Snowden could not have had a girlfriend > before his trip to Hong Kong is baffling and inexplicable; he > was leading a perfectly normal life for someone in his > position. Both social and economic documentation of their > relationship exists. I never insinuated that Snowden "could not have had a girlfriend." What I have said is that the absence of any indications of a particular girlfriend other than three words spoken by Ed Snowden, raised the question of whether that particular person did exist. Now we do have fairly persuasive evidence of her existence, to integrate into our interpretation of The Snowden Saga - if we remain interested enough to bother. > (And your bringing up of her hobbies in this context seems to > betray a kind of naiive mistrust on your part; a majority of > my friends who are atheletic and in the 25-35 age bracket have > tried out pole or other circus arts. It's fun!) In The Snowden Saga, Lindsay initially existed only as three words spoken by Ed Snowden when describing the way of life he sacrificed to undertake his heroic quest: "Pole dancer girlfriend." The appearance of a person named Lindsay in the new film, along with the story that he met her in a bar in Japan and that she followed him to Hawaii, is the first corroborating evidence that this person ever existed. Now she appears as the most influential person in Ed's life during the time frame when he decided to abandon his entire way of life and become a fugitive facing life in prison for the sake of a Holy Quest. Questioning whether Ed Snowden was really a free agent, vs. an unwitting agent exploited by a U.S. (or other) intelligence operation, is obviously out of bounds. So that's what I do. To date, nothing that well informed members of the public did not already know or confidently guess about the capabilities and activities of the NSA has been revealed by any of the releases attributed to Snowden. I also see that every supposedly controversial legal or policy issue raised by The Snowden Affair was already settled in the intelligence community's favor, in Courts and Congress, years earlier: The most genuinely controversial document released was the first one, an order demanding Verizon's call records; that was a fight the intelligence community was well prepared to win and they did so handily. Anyone who studies the history and current activities of the intelligence community learns early on that final answers are very elusive. Insiders describe the intelligence world as a "wilderness of mirrors." Elaborate and long-running deceptions are business as usual: Familiar examples include the complete British control of German intelligence networks in England during World War II, Soviet placement and maintenance of high level double agents inside the CIA during the first Cold War, and numerous false flag operations by everybody, such as Israel's failed Lavon Affair. Observers inside the intelligence services are little better off than those on the outside when it comes to getting the straight story: Histories created for internal consumption by outfits like the CIA routinely gloss over controversies and endorse falsehoods. In today's world it is not possible to stop leakers from leaking. But it is very possible to create controlled leakers of one's own, and use them to pull public attention away from the genuine article, saturate relevant press resources, and keep legal and legislative overseers busy chasing after one's own chosen allegations and indiscretions. If Ed Snowden did not exist, it would be necessary to create him. I have no reason to believe that Ed Snowden is anything other than what he appears to be: An idealist who has been used as a means to an end. This leaves the question, used by whom and for what ends? One can choose a side to take and adjust one's beliefs accordingly, or leave questions that do not yet have answers open. That is why I thought the LeGuin quote was very appropriate in the present context: "Those whom heaven helps we call the sons of heaven. They do not learn this by learning. They do not work it by working. They do not reason it by using reason. To let understanding stop at what cannot be understood is a high attainment. Those who cannot do it will be destroyed on the lathe of heaven." :o) Steve -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJUTvCRAAoJEDZ0Gg87KR0LX+4P/iGUW0n3vLooFPBIDKvLSCi0 1S8W9wM42AOlF/fR0elkgSi83qlfOEqrpTow0sQMFXDbA4drwfQLpQlLHZdQp6Wk tunG9OpcbLlKEFotxWYx2SrhihAqWSpPrhccEriT7+9FzvaaraeObRZKZqxoM+Tz ZsJTzV6Hk3IUJeTXPSoeFr1RCtFrUpI6IhK49iltKMJA2T43q74oRI9R/TV0B8vB pKXjdutQQnIyuf0CVjKl7kwIzu3/BYjETGJ/N/N77gjnQEIYtHBB5E7tQdkzEFE3 nvPJEOCkRrFbWqLGYQyDweuwX/R/COLPIBK7F4eLOttColx/nH5jSQIV/yz6Nu4i HFMKCAGUgrS+fZeWeth2RcK1V1UP5kC8ysxWGRbATNUSW0uDfZmonu9C6vrmVBE1 P7R/3+Yz/2MFxz7x+C1KN6s/ivX9FAyhBvFcdgsCFv0Q4X2lI9PHXNSBKfcevFDg q84Xla5dFkYOtoyW0qINcJCi8HueCS9c3MhOWirVmafam/zStlGgL3dO9ltKfwio jYX/RMx15GnMBfKkWZzd856PIz9xms+qbXJg69+4+IWBcGM+NrGN7eZQYI+zzgEn +xjoZ3xRjQcwayZ/mA8NBCKUkapXCcmcvYoZ8DzWKadeEW/5aEMMrf1C10OVI2Jb JHkl1gYWmgXKl/Q2erVc =iLU2 -----END PGP SIGNATURE-----

3 2