- cypherpunks - lists.cpunks.org

Re: [Cryptography] hard to trust all those root CAs
by grarpamp 23 Jul '14

23 Jul '14

On Sat, Jul 19, 2014 at 5:03 PM, John Denker <jsd(a)av8n.com> wrote: > AFAICT, a lot of existing protocols were designed to resist > passive eavesdropping. In contrast, the idea of large-scale > MITM attacks was sometimes considered tin-foil-hat paranoia. > To this day, standard Ubuntu Firefox trusts 162 different > authorities (including the Hong Kong Post Office) to certify > /anything and everything/. > > In the /usr/share/ca-certificates/mozilla directory, only one > of 163 root certificates has any v3 Name Constraints at all. > Why Ubuntu and Firefox tolerate this is beyond me; I can > understand trusting Microsoft to sign Microsoft-related stuff, > but allowing them to sign /anything and everything/ ?!????!! The mozilla bundle includes about 150. It would be nice if the new cert observatoris publish a count of how many end certs they see each root cert covers... a topN list of sorts. Then you could save some time by including the N of your choice into your 'empty by default' list. I think the distribution would be severly skewed to maybe top 10 or 15 covers most any place.

2 2

Re: Gruveo, more secure skype alternative?
by John Preston 23 Jul '14

23 Jul '14

You can find the results of my inquiry below. ¬_¬ -------- Forwarded Message -------- > From: Art Matsak <art(a)gruveo.com> > To: John Preston <gizmoguy1(a)gmail.com> > Subject: Re: Security specifics > Date: Wed, 23 Jul 2014 18:34:28 +0200 > > Hi John, > > Thank you for your interest in Gruveo. Gruveo uses WebRTC, an open technology for browser realtime communication. You can find details on its security architecture here: > > http://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-10 > > Please note that WebRTC is work in progress and its specifications may change in the future. > > To answer your other questions, Gruveo is a proprietary product. > > Best regards, > > Art Matsak > Founder and CEO > Gruveo > https://www.gruveo.com > > > On 23 Jul 2014, at 18:19, John Preston <gizmoguy1(a)gmail.com> wrote: > > > From: John Preston <gizmoguy1(a)gmail.com> > > Subject: Security specifics > > > > Message Body: > > Hey all, > > > > Like the idea, but I'd like to know about the specifics of how Gruveo is designed. Specifically: > > * what is the threat model? > > * what are the network protocol specifications? Packet formats, ciphers and modes, and semantics all critically determine the security of the system. > > * who owns the IP, and how is it licensed? > > * what's the development model like? > > > > Thanks for your time, :) > > John > > > > -- > > This mail is sent via contact form on Gruveo https://www.gruveo.com > >

2 1

Compromise of Soviet codes in WWII
by grarpamp 23 Jul '14

23 Jul '14

http://chris-intel-corner.blogspot.gr/2014/07/compromise-of-soviet-codes-in… Overview of Soviet cryptosystems The secretive Soviet state used various cryptosystems in order to secure its communications from outsiders. The task of preparing and evaluating cipher procedures was handled by two main Soviet organizations, the NKVD’s 5th Department and the Army’s 8th department of the main intelligence directorate GRU. In the 1920’s simple substitution systems were used and these were solved by ...

1 0

Alleged IOS backdoors
by Georgi Guninski 23 Jul '14

23 Jul '14

Alleged IOS backdoors http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS_Backdoors_Atta… Identifying Back Doors, Attack Points, and Surveillance Mechanisms in iOS Devices JONATHAN ZDZIARSKI

4 4

Tor developers vow to fix bug that can uncloak users
by Eugen Leitl 23 Jul '14

23 Jul '14

http://arstechnica.com/security/2014/07/tor-developers-vow-to-fix-bug-that-… Tor developers vow to fix bug that can uncloak users Weakness was topic of talk abruptly pulled from security conference. by Dan Goodin - July 22 2014, 8:15pm CEST Developers of the Tor privacy service say they're close to fixing a weakness that researchers for an abruptly canceled conference presentation said provides a low-cost way for adversaries to deanonymize hundreds of thousands of users. The talk previously scheduled for next month's Black Hat security conference in Las Vegas was titled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget." The abstract said that the hack cost less than $3,000 and could uncloak hundreds of thousands of users. On Monday, Black Hat organizers said the presentation was canceled at the request of attorneys from Carnegie Mellon University (CMU), where the researchers were employed, as well as the Software Engineering Institute (SEI). The attorneys said only that the materials to be presented "have not yet been approved by CMU/SEI for public release." Researchers Alexander Volynkin and Michael McCord have yet to explain why their talk was pulled. Tor officials responded by saying that they're working on an update for individual Tor relay nodes that will close the unspecified security hole. "Based on our current plans, we'll be putting out a fix that relays can apply that should close the particular bug they found," Tor project leader Roger Dingledine wrote in an e-mail to Tor users. "The bug is a nice bug, but it isn't the end of the world. And of course these things are never as simple as 'close that one bug and you're 100% safe.'" He said the fix was complicated because the researchers didn't provide all the technical details when privately informing Tor officials of the vulnerability. "We've been trying to find delicate ways to explain that we think we know what they did, but also it sure would have been smoother if they'd opted to tell us everything," he wrote. "The main reason for trying to be delicate is that I don't want to discourage future researchers from telling us about neat things that they find. I'm currently waiting for them to answer their mail so I can proceed." In a previous e-mail, Dingledine said Tor developers "informally" received some materials related to the vulnerability. He went on to say Tor officials played no role in the cancellation of the Black Hat talk. "We did not ask Black Hat or CERT to cancel the talk. We did (and still do) have questions for the presenter and for CERT about some aspects of the research, but we had no idea the talk would be pulled before the announcement was made," he wrote. CMU is affiliated with CERT, which coordinates security disclosures between researchers and affected parties. A CMU spokesman contacted Monday didn't elaborate on the reasons for pulling the talk.

2 1

HackRF will likely start shipping in August
by Eugen Leitl 23 Jul '14

23 Jul '14

(the tinfoilhatterati will understand and rejoice) https://greatscottgadgets.com/hackrf/ HackRF One is now available for pre-order from: HakShop (US) NooElec (US/CA) Hacker Warehouse (US) Ada's Technical Books (US) Wall of Sheep (US) Store4Geeks (SE) Passion Radio Shop (FR) Passion Radio Shop UK (UK) TAPR (US) iSource Asia (CN) WiMo (DE) Pre-ordered units will ship immediately after all rewards have shipped to Kickstarter backers, estimated July 2014. For the latest information on development and manufacturing, follow the Kickstarter updates.

3 2

web based shared secret symmetric encryption application
by Cryptoparty Marseille 22 Jul '14

22 Jul '14

Hi! I'm looking for a decent free and open source application that would work similarly to "Hushmail Express message" (https://help.hushmail.com/entries/351388-I-have-received-an-encrypted-email…) that would allow me to deposit an encrypted message on an apache web server that would be decrypted by the recipient using a shared secret (that's already established, so I don't need a key exchange mechanism). I read Tony's posts and his blog article (http://tonyarcieri.com/whats-wrong-with-webcrypto) and I'm well aware that browser based encryption is not optimal but I'm just looking for something slightly more secure than plain text email that could be used by an end user not willing to install GPG, not an NSA proof secure system. The (apache2/debian7) web server is physically under my control, I'm the only root (I hope! :-) and SSL/TLS is enabled. Thanks for your advice. cryptomars

3 2

Fwd: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws
by coderman 22 Jul '14

22 Jul '14

thanks Eugen! ---------- Forwarded message ---------- From: Eugen Leitl <eugen(a)leitl.org> Date: Tue, Jul 22, 2014 at 1:30 AM Subject: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws To: tor-talk(a)lists.torproject.org, Liberation Technologies <liberationtech(a)lists.stanford.edu> https://www.techdirt.com/articles/20140721/11362227955/carnegie-mellon-kill… Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws from the questionable-legality dept There's some buzz in security circles today after it came out that a session at the upcoming Black Hat Conference entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" by Michael McCord and Alexander Volynkin (both of whom work for Carnegie-Mellon University and CERT) had been pulled from the conference at the request of CMU. A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment. There's been plenty of speculation about what's going on, but Chris Soghoian has a pretty good thesis that the researchers likely didn't have institutional approval or consent of the users they were identifying, meaning that they were potentially violating wiretapping statutes. As he notes, running a Tor server to try to spy on Tor traffic without talking to lawyers is a very bad idea. While it hasn't yet been confirmed that this is what happened, it certainly is a pretty sensible theory. Of course, none of that changes the fact that it's possible to identify some Tor users. But... that's also not particularly new. In fact, we've discussed in the past how the feds can identify Tor users. Tor adds an important layer of protection, but there are plenty of ways that you can still be identified while using Tor. Just ask Russ Ulbricht. The problem isn't so much Tor itself but how people use it -- and the simple fact is that most people use it in a way that will eventually reveal who they are. While it's not definite, it seems likely that this is what the talk would have revealed. Shutting it down wasn't any sort of big attempt to cover up this fact, but perhaps it was to protect the researchers and CMU (potentially) from a lawsuit for violating wiretapping laws.

2 1

shipment interdiction [was: BadBIOS forensics]
by coderman 21 Jul '14

21 Jul '14

On Wed, Jul 16, 2014 at 4:19 AM, Bluelotus <bluelotus(a)openmailbox.org> wrote: > ... > My laptops were indicted, infected and implanted. and now they're getting thoroughly cleaned, see attached. please note for all future reference that suspect materials should be delivered in person, even at cost of a plane ticket. so much for that inquiry, :/ best regards, (attached interdiction of shipment from Washington State to Oregon via Florida - usually they at least try to make it look plausible, heh) https://peertech.org/files/fedex-fail.jpg

2 2

Re: [liberationtech] Foxacid payload
by coderman 21 Jul '14

21 Jul '14

On Thu, Jul 17, 2014 at 12:19 PM, Andy Isaacson <adi(a)hexapodia.org> wrote: > ... > And once you've patched this bug, FOXACID will update to issue another > 0day. > > It's worth doing, for sure! Patching bugs makes us all incrementally > safer. > > But don't pretend that patching the specific attack your adversary is > currently using will disable or even seriously inconvenience the > adversary. this is exactly why some who have received these payloads are sitting on them, rather than disclosing. it is more useful to mitigate privately, and observe how/when an exploit is used, than burn it publicly for zero effective security improvement. (the less scrupulous would sell to highest bidder for other clandestine hacks) better ideas welcome! best regards, -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

2 1