- cypherpunks - lists.cpunks.org

Rainforest Connection and WildLeaks
by Eugen Leitl 15 Jul '14

15 Jul '14

Interesting uses of old mobile phones https://www.kickstarter.com/projects/topherwhite/rainforest-connection-phon… (I'm sure you'll how this be made applicable in other contexts (say, urban environment) and with other modifications). One group hopes to end poaching, WikiLeaks-style http://www.pri.org/stories/2014-07-14/one-group-hopes-end-poaching-wikileak…

1 0

Experts report potential software "back doors" in U.S. standards
by Eugen Leitl 15 Jul '14

15 Jul '14

http://www.reuters.com/article/2014/07/15/usa-nsa-software-idUSL2N0PP2BM201… Experts report potential software "back doors" in U.S. standards BY JOSEPH MENN SAN FRANCISCO, July 14 Mon Jul 14, 2014 8:58pm EDT (Reuters) - U.S. government standards for software may enable spying by the National Security Agency through widely used coding formulas that should be jettisoned, some of the country's top independent experts concluded in papers released on Monday. Such mathematical formulas, or curves, are an arcane but essential part of most technology that prevents interception and hacking, and the National Institute of Standards and Technology (NIST) has been legally required to consult with the NSA's defensive experts in approving them and other cryptography standards. But NIST's relationship with the spy agency came under fire in September after reports based on documents from former NSA contractor Edward Snowden pointed to one formula in particular as a Trojan horse for the NSA. NIST discontinued that formula, called Dual Elliptic Curve, and asked its external advisory board and a special panel of experts to make recommendations that were published on Monday alongside more stinging conclusions by the individual experts. Noting the partially obscured hand of the NSA in creating Dual Elliptic Curve - which Reuters reported was most broadly distributed by security firm RSA [USN:nL2N0JZ1B6] - the group delved into the details of how it and other NIST standards emerged. It found incomplete documentation and poor explanations in some cases; in others material was withheld pending legal review. As a whole, the panels recommended that NIST review its obligation to confer with the NSA and seek legal changes "where it hinders its ability to independently develop the best cryptographic standards to serve not only the United States government but the broader community." They also urged NIST to weigh the advice of individual task force members who made more dramatic suggestions, such as calling for the replacement of a larger set of curves approved for authenticating users, in part because they were selected through unclear means by the NSA. "It is possible that the specified curves contain a back door somehow," said Massachusetts Institute of Technology professor Ron Rivest, a co-founder of RSA and the source of the letter R in its name. Though the curves could be fine, he wrote, "it seems prudent to assume the worst and transition away." More broadly, Rivest wrote, "NIST should ask the NSA for full disclosure regarding all existing standards... If NSA refuses to answer such an inquiry, then any standard developed with significant NSA input should be assumed to be `tainted,'" absent proof of security acceptable to outsiders. In an email exchange, Rivest told Reuters that "NIST needs to have a process whereby evidence is publicly presented" about how the curves were chosen. The curves faulted on Monday had been questioned by outsiders after media reports in September said the NSA could break much widely used security software, without detailing which ones or how. "These curves are ubiquitous in commercial cryptography," Johns Hopkins University professor Matthew Green said in an interview. "If you connected to Google or Facebook today, you probably used one." Rivest's long association with RSA, now part of electronic storage maker EMC Corp, made his remarks more poignant. But prominent task force colleagues including Internet co-creator Vint Cerf and Ed Felten, former chief technologist at Federal Trade Commission, also gave strongly worded verdicts on the Department of Commerce unit. "It cannot be accepted that NIST's responsibilities should be co-opted by the NSA's intelligence mission," wrote Cerf, who now works at Google Inc. While Rivest called the internal history of Dual Elliptic Curve a "smoking gun" with an "almost certain" NSA back door, Felten wrote that NSA might not remain alone in its ability to use it and other possible NIST-approved holes for spying. In each of three cases, including Dual Elliptic Curve and the more common curves faulted by Rivest, Felten said the suspected back door access "reduces the security of users against attack by other adversaries, including organized crime groups or foreign intelligence services." The NSA might have been able to generate curves that pass cursory security tests but are still breakable through the aid of sheer computing power, because it can try millions of curves and get a few that fit its goals. But a researcher working for another country could discover the flaw, Felten said. In the case of the curves approved under the FIPS 186 standard for authenticating digital signatures, NIST should start over and pick its own curves publicly rather than relying on the NSA, Felten and others said. Several experts said NIST had to hire more cryptographers and strengthen its internal processes to avoid relying on NSA. NIST acting Director Willie May agreed in a statement, saying his agency "must strengthen its in-house cryptography capabilities to ensure we can reach independent conclusions about the merits of specific algorithms or standards." NIST did not respond to a Reuters email asking about the fate of the suspect curves. (Reporting by Joseph Menn; Editing by Ken Wills)

2 1

Re: [tor-talk] Questions about NSA monitoring of Tor users.
by Eugen Leitl 14 Jul '14

14 Jul '14

----- Forwarded message from Mirimir <mirimir(a)riseup.net> ----- Date: Sun, 13 Jul 2014 20:01:10 -0600 From: Mirimir <mirimir(a)riseup.net> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] Questions about NSA monitoring of Tor users. Message-ID: <53C339E6.3060205(a)riseup.net> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 Reply-To: tor-talk(a)lists.torproject.org On 07/13/2014 06:57 PM, z9wahqvh wrote: >> >> ---------- Forwarded message ---------- >> From: Mark McCarron <mark.mccarron(a)live.co.uk> >> Date: Sun, Jul 13, 2014 at 9:27 AM >> Subject: Re: [tor-talk] Questions about NSA monitoring of Tor users. >> To: "tor-talk(a)lists.torproject.org" <tor-talk(a)lists.torproject.org> <SNIP> >> Did no one notice trillions are being drained from the US economy >> into some unidentified military project for the last decade or more??? >> >> It would seem to indicate that there is a Manhatten-style project underway. >> >> do you have any links or additional info about this? beyond the vague > sense of large black budgets, I'm not sure exactly what you might be > referring to. Well, the modern NSA _is_ a Manhattan-scale project. According to Wikipedia[1]: | The Manhattan Project began modestly in 1939, but grew to employ | more than 130,000 people and cost nearly US$2 billion (about $26 | billion in 2014 dollars). A Snowden leak reveals that NSA's budget has grown from about 7e+9 USD per year in 2004 to about 11e+9 USD per year in 2014[2]. The 2004-2014 total is about 91e+9 USD, well over three times the stated total for the Manhattan Project. But that doesn't count cleanup costs. For the Hanford site alone, Wikipedia reports[3]: | Citing the 2014 Hanford Lifecycle Scope Schedule and Cost report, | the 2014 estimated cost of the remaining Hanford clean up is $113.6 | billion - more than $3 billion per year for the next six years, | with a lower cost projection of approximately $2 billion per year | until 2046. So, even counting cleanup costs, they're comparable. Perhaps Mark can add some specifics that haven't come out yet. [1] http://en.wikipedia.org/wiki/Manhattan_Project [2] http://www.washingtonpost.com/blogs/wonkblog/wp/2013/08/29/your-cheat-sheet… [3] http://en.wikipedia.org/wiki/Hanford_Site -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message -----

2 1

Re: Cypherpunks for Office [Edu/corp giving personal information to NSA/whoever]
by nicolasbourbaki＠riseup.net 14 Jul '14

14 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Pirate Party and Cypherpunks party are populous movements attempting to play the game within the construct of behavior most expected. The establishment of a party itself with intent for longevity is entirely unnecessary for what needs to be done. Most people here should understand that ignoring ones own brand by removing it entirely from the picture gives greater focus to a singular ideal. Don't mistake this rhetoric for revolution. It is only that Democracy has plenty of room for trolling and no one has really figured this out yet. Unbeknownst to most people born within the past 20+ years they were all born with dual citizenship. First to their analog nationality and second to the https://en.wikipedia.org/wiki/Fourth_Estate. Yochai Benkler expands on this definition when describing Wikileaks as part of the Networked Fourth Estate. That is, media institutions not beholden to any particular nation. I would extend this further to include people that took upon themselves an alternate understanding of rights, social norms, governance and behaviors as experienced through the network as an unwritten constitution. This is not just hackers and cypherpunks but many internet users as a whole. It includes *every* internet user that found any form of solace or confidence through the liberated network. At this moment in time you could be an American, European, South African or Brazilian and all will collectively notice that this alternate constitution is under attack, even if its existence is unknown. The Pirate Party most certainly attempts to represent this 4th estate. I applaud them. The reason they might fail to fix the most significant problems we currently face is due to their quest for longevity and a brand. We do not need 4 or 10 years to fix these problems. We only need 100 days. On 12/07/2014 20:47, Blibbet wrote: >> Cypherpunks should run for office and disrupt this shit. >> It's now or never. > > Check out the Pirate Party. IMO, it should be called the > Hacker Party, or the Technology Party. > > http://en.wikipedia.org/wiki/Pirate_Party > > In a few days, or when our Open Video volunteer finishes > postproduction, look on at the TA3M Seattle web site for an > URL to last month's talk from a Seattle-area Pirate Party > orginizer. > <https://wiki.openitp.org/events:techno-activism_3rd_mondays:seattle/> > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJTwd0qAAoJEHi6xtksL8/uzYUP/173TrgtoO7b3Ph+2juBtQcm x9f/KOF/qs/gGaGv8857QOiVUV+KefbMTvg6D4cuPXDIT+VKeMbg1tLDyOCMjLZE zHoToj/UA70J8j66LZN3B+LmNpdxhJijBQfiZBas7yUd2/NHZKbHkBXjUy4jrR++ jRv/DgNeLDQe/EVabQvFJYv397WRpegxJonJmuUSOKS48jCy07hnAEyopJgDQOhd I8iUYH6YtcAZ47kiMxrYgMX4W7Xm4eolpqLWXxGdwB8gmxGxTkoQYM4vorYYzMib EQGvLgVYeMVEmWPQuJ9X4JQJR4BThBiCx5/O1lqdR0akA23Vtm6RAkW+QSm/SqL4 Fxv1ryUCZk/dxOgbaYprBgm5UbhBmAoC1GN9oz4HzGwFIwWmaCnfzM2p7jIGIUb3 LtgUwXya9rxv8ihXDISwIEu8iqYzI4kkJeFUBCh9WyJXPXjc9T1JAW+BQ7T+hKjb 9W9Q7VAMGkFaW4dsmpm/47ZIQnBVU3IyJzk9P3gEYZE1lFleejsvyZL02WPjT7QJ 12gd7QzEoXD2SAjpDQV0Wp0v/OyrUkCV84G6xDDtxnlEfKFYzbjadikyedOss9e9 NzUp4r2QztY/wP/ZyEALlV0yaU53Jv9GRB5OHWdDxv8iWWSIe1Xa/JIFY+ztP9Me ffknV+yAnaIT/DxPjSnz =D7gB -----END PGP SIGNATURE-----

4 4

Fwd: [tor-talk] Questions about NSA monitoring of Tor users.
by grarpamp 13 Jul '14

13 Jul '14

Trillions? ---------- Forwarded message ---------- From: Mark McCarron <mark.mccarron(a)live.co.uk> Date: Sun, Jul 13, 2014 at 9:27 AM Subject: Re: [tor-talk] Questions about NSA monitoring of Tor users. To: "tor-talk(a)lists.torproject.org" <tor-talk(a)lists.torproject.org> I can answer this: 1. The IP addresses can be connected to an ISP and physical address should the need arise. It allows the NSA to "rewind the tape" so to speak. That is why there has been a push for data retention at ISPs. Given that in the EU governments are seeking 2 years, it would indicate that the platform can rewind internet activity for at least that long. 2. Tor is a communications platform, the NSA's job is to monitor communications and intercept military planning that effects either itself or its partners. Secure global communications and computing is now a commodity, whereas it was mainly a state-only capability. Thus, the average user is now coming up against intelligence agencies, rather than state actors alone. Leaving blind spots would be dangerous to national security as it provides opportunities for planning and coordination. So, there is a legitimate case here and no one denies it. The real problem is that in the absence of a genuine international threat and by that I mean someone on the scale of Russia/China, these systems are being directed against groups with limited capabilities. Those groups are now being defined as national security threats to justify budgets and to filter money into particular black projects. Revelations by Snowden and other releases are merely a distraction to where the money is really going. Did no one notice trillions are being drained from the US economy into some unidentified military project for the last decade or more??? It would seem to indicate that there is a Manhatten-style project underway. Regards, Mark McCarron > Date: Sat, 12 Jul 2014 23:14:30 +0000 > From: simonsnake(a)openmailbox.org > To: tor-talk(a)lists.torproject.org > Subject: [tor-talk] Questions about NSA monitoring of Tor users. > > I have two questions about the recent revelations that the NSA has been > collecting data about Tor users. > > I would like to hear from those with personal knowledge and experience > such as Jacob, Roger, Mike, etc. > > AIUI, from the stories in the German media > (http://daserste.ndr.de/panorama/aktuell/nsa230_page-1.html) and Wired > (http://www.wired.com/2014/07/nsa-targets-users-of-privacy-services/) > the NSA has logged the IP of everyone who ever accessed: > a) a directory server. > b) an entry node. > c) bridges.torproject.org > d) requested an email of bridges. > e) the tor website itself (except from five eyes countries). > > This is viable as the NSA runs the Quantum network which allows it to > intercept traffic to whichever sites it desires before that traffic > arrives at its destination. > > Two questions: > > 1. What would be the purpose of collecting a vast trove of IP addresses? > In my case, my IP could be tied to my real name since I send emails via > SMTP which will contain my IP, email address, real name, etc. That said, > IP addresses are dynamic. I don't know how easy it would be to identify > most people via an IP. Of course, one way would be to ask the ISP > directly. But, whether tied to a real identity or not, what's the point? > What does it achieve? They also gather the IP address for those who > access any number of proxy services such as MegaProxy and > FreeProxies.org. Would they not just end up with a massive database of > (mostly dynamic) IPs? > > 2. What is the attitude that encourages the gathering of this > information? Is it: because they can? Or do they truly believe that > anyone who uses Tor is dangerous? Bear in mind that Tor was developed > and is still funded by the US government. No-one can deny that > dissidents in unfree countries use it. So, even if you assume that a > high percentage of users are bad people, what about the dissidents in > the Middle East or wherever? What is the psychology here? I'm sure > people like Roger are in regular contact with some government types. > Perhaps he can shed some light on the motivation? > > > -- > tor-talk mailing list - tor-talk(a)lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

2 1

Cypherpunks for Office [Edu/corp giving personal information to NSA/whoever]
by grarpamp 13 Jul '14

13 Jul '14

> Sayeth James Murphy: > ... > A quick search shows that this privacy policy is spreading. > How can I stop it? I get the feeling calling management's phone isn't > going to do much. No corp/edu/gov entity intrinsically gives a fuck about your privacy, and their only incentive is covering their ass and kissing others. Sorry to break it to ya bro. The only ones that give a fuck are the people, and the people need to provide said entities with drastically more convincing incentives than the current set. Cypherpunks should run for office and disrupt this shit. It's now or never.

4 5

data mine the snowden files [was: open the snowden files]
by coderman 12 Jul '14

12 Jul '14

On Sat, Jul 5, 2014 at 11:29 AM, Geert Lovink <geert(a)desk.nl> wrote: > ... > the snowden files are of public interest. but only a small circle of > people is able to access, read, analyze, interpret and publish them. and > only a very small percentage of those files has been made available to > the public... > > what can be done about this situation? are we able to find a way to > "open" this data? and in the course of this create a modell for future > leaks? > .. > prior to my intervention harding had already hinted at some very obvious > limitations of the ongoing investigation, alluding to various reasons > why those "few lucky ones" are incapable to deal with the investigation > challenge in an approriate manner: "we are not technical experts" or > "after two hours your eyes pop out". inspite of this, harding seemed > unprepared to refelect the possibility to open the small circle of > analysts dealing with the snowden files. an impasse of extremes, a full or limited dump off the table. let's find a middle ground. how best to proceed? > * last but not least: one should work out a concept/model for > transferring those files into the public domain -- taking also into > account the obvious problems of "security" and "government pressure". > > it would be great of we could start a debate about in order to build a > case for the future of handling big data leaks in a more democratic and > sustainable manner. very great indeed. what kind of tools would make the journalists involved more effective and productive? 1. using the leaks currently published, devise a framework for "data mining" the leak documents, aka, generating metadata from the data and operating various matches and relevance across the metadata to narrow the search and aggregate related efforts or technologies across their compartmentalized worlds. 2. #1 requires that there is an index of special terms, techniques, suppliers, code names, algorithms, etc. that used to generate the metadata for deeper search and tie to general themes of surveillance. 3. extrapolating from current leaks, also look toward recent advancements and specific technical tell tales of interest. doping silicon as tailored access technique? this could refer to compromised runs of security processors for desired targets. etc. 4. justifying technical detail specifically. we have seen so little technical detail of the source code / hardware design level. how best to justify source code - explaining that the language choice, the nature of the algorithms, the structure of the distributed computing upon which it runs all conveys critical technical details important to understand what part of our technologies are compromised, and guiding the fixes required to protect against such compromises? in short, it would behoove us to build tools to make the journalists more effective, rather than bitch about not being included in the inner circle. (sadly, many good knowledge discovery tools are proprietary and applied to open source intelligence) what types of features would you want such a leak-assistant software to have? what types of existing tools, if any, would provide these capabilities? best regards,

6 12

Universities giving personal health information to NSA
by James Murphy 11 Jul '14

11 Jul '14

Seen in: http://www.healthyhorns.utexas.edu/IMAGES/pdf/privacypractices.pdf http://www.cmhc.utexas.edu/ppn.html What Are Other Way UHS [University Health Services] May Use Your PHI [Personal Health Information]? - National security and intelligence activities. No warrant, no judge, just "activities." A quick search shows that this privacy policy is spreading. How can I stop it? I get the feeling calling management's phone isn't going to do much. -- James T. Murphy III jtmurphy(a)cmu.edu PGP Key-ID: 0x67E3BC49, available at keys.gnupg.net, pgp.mit.edu.

1 0

Chile, project to modify the penal code.
by deoxyt2 11 Jul '14

11 Jul '14

Attached document [es] which attempts to modify the penal code of Chile, which involves reducing the freedom of expression in our country. A part of the amendments says: Add how numeral 3rd of article 261 of the title VI: Those who make threats or utter insults against the authority by means of electronic platforms, either textual or graphical, form being considered as aggravating circumstance that don't do it with your true identity or that attempt to impede the identification of the computer from which the message spreads. Regards. deoxyt2.-

2 1

GeoIP is a threat to democracy
by Nicolas Bourbaki 11 Jul '14

11 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It seemed logical that old-world media companies would want to restrict access to content on the Internet. GeoIP was then used to induce distribution barriers analogous to those found offline so that existing models of rent extraction could survive. And while this is something most of us would be fine with leaving to the invisible hand of the market we can not take the same stance when governments start to use these measures to dictate who is a citizen, and who is not, and who is provided civil liberties and who is not. This is what the XKeyscore rules made clear was happening and will continue to happen in the future. The internet standards and governing bodies cannot relinquish themselves of political responsibility any longer. The structure of a protocol will dictate our behavior and in this world there is no such thing as an agnostic protocol. The term "neutrality" is false. In the context of service providers battling with media providers over who gets a larger share of rent from consumers, "neutrality" may be the agreed upon term but the policies that result from this debate will have real impact on our behavior, the ethics of the protocol, and our liberties. Once a neutral protocol is understood as an oxymoron standards bodies with charters claiming to serve the betterment of all nations, corporations and consumers should be clearly seen for what they are: a new Tower of Babel. Those of us still placing stones one on top of the other within these institutions should take a moment to look at our work and ask what are we actually doing. In 2010 the DHS went against their own charter and hijacked ICANN's to take down hundreds of domains for unclear copyright claims. Why is ICANN still relevant when decentralized models could easily replace them when supported by either the EU, Google or Firefox? And when the NSA can with absolutely no oversight claim that the location of an IP in some table dictates who gets civil liberties, why have we not replaced BGP or at least begun to build parallel models within universities or like minded corporations that could support reverse tunnels through collision free identities similar to Tor's onion service handles? The number of protocols that falsely advertised as agnostic are many. We should be ashamed that it took such a scandal as pervasive western surveillance to awaken us to this falsehood when so many, living under more hostel regimes, have lived with the tools of oppression we built into these protocols from the very start. If we cannot convince our institutions to take fixing these falsehoods seriously by considering civil liberties within the protocol, and overcome the obstacles of legacy systems, and work for support for parallel models, than at least we can hasten the demise of this Babel to start anew. Indeed this may sadden optimists such as Larry Page and others that are waiting for technology to become our messiah. But as Benjamin Franklin would say, those who would trade liberated networks for efficient networks deserve neither. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJTv3iAAAoJEHi6xtksL8/uJo4P/jf7RVFFJKtUD5VmEzWUr7eK 2B74/ksSqjJWyqHCVcWCRVIQpokzgBq6cwITNRky8ahh0I1+4NORJVOj++n9b6d0 4Wv2mihZpEdIOLOZZESSYgb05L9rPXuX8HTdOtWkbFgpcofXqO59Q1Y6xOKhdZlI 2PwZTXUkmnqycv7cE1n6GgYrR41M+RZzXSiEEHqeVi3pbfYGEaTTX78vcmYzmMGP E7NlJzUvwWRLZMnX9+RN0qUiZQsqKRhOYwfl3Pj7XOo7GNlUqGcphY+cQUHTSNf5 i3HZbblq3UDCAQ7kWFiX+yj5NGVAyfUVBYxJx0/RrJf5zcG9JfzKPXuOtlfeq/yF G9SJ+qCydnCzDmdZCphw0pcGOZnDRBPQzUjd+bdjpBbv2y76Jz3zKzj3Jv1QjkeN NMaw7fGfJ4uTCddFJv2gLdgB0BZta6shhqBoca3k03qWJAmKkp4/559ApoZo8Eyz Gg8+iwPQPsew/2SpXtV6uj1jyLcy36jM1F0IC4OkfGwAFyHJ+Xy/QQehJLlZ+yPO r+aLDIN1+a1ydLINCcv9OhVQCuUO9vfPah0TB2Jql+kD05MNfMnDtTMYVgQaMlcd o+QOj9U2fhVN5qWpMWoxathO0k+L1nwIMUqpMi6GOMS9wqw8pUCdoBhDka/FElQG 50CdY4PooGDfOksxeF+G =3CPP -----END PGP SIGNATURE-----

1 0