- cypherpunks - lists.cpunks.org

US Government Changes Russian Election Hack Lie
by Razer 06 Jan '17

06 Jan '17

The Russian Hacking accusation changes: Three *Unnamed* US officials now claim Russia gave hacked material from DNC to WikiLeaks via some 'Third Party'. The only Third Party I know of is a former UK ambassador who claims he delivered the DNC dox to @Wikileaks from a disgruntled DNC worker. Will they claim that worker is a Russian Mole? The Dems are already insinuating that the president-elect is... Standby, and never mind the Fascist behind the curtain who will soon be your ruler... #DonaldTrump. Not a Russian mole. The Ugly American http://sjlendman.blogspot.com/2017/01/new-twist-on-fake-news-russian-hackin… also see: @thegrugq @ Twitter > > "There’s been a lot of predictions that France and Germany are next > due for Russian active measures targeting the elections." > https://twitter.com/thegrugq/status/817185048642265089 Since they're totally under cyber-surveillance now, it WOULD be a great time for Russia to Hack an election. Someone's full of shit. The whole narrative is... How did Mark Twain put it? > > Why, the other pretext was thin enough, but this is thinner than ever; > the other was tissue, tinfoil, fish-bladder, but this is gold-leaf... > PLYMOUTH ROCK AND THE PILGRIMS ADDRESS AT THE FIRST ANNUAL DINNER, N. E. SOCIETY PHILADELPHIA, DECEMBER 22, 1881 http://twain.lib.virginia.edu/onstage/pilgrims.html

1 0

Call for Cypherpunks historians
by Bruce Fenton 06 Jan '17

06 Jan '17

Hi all, I'm working on a book about blockchain tech and one chapter covers some of the earlier discussions which originated from this list. Anyone who'd be willing to be interviewed on 1) the earlier days of this list 2) thoughts on blockchain tech, Bitcoin and overlap between that tech and Cypherpunks -- your help would be appreciated Thanks! Bruce Fenton

5 4

Cryptocat -vs- PGP (https://crypto.cat/)
by Александр 05 Jan '17

05 Jan '17

An Open Letter to The New York Times December 17, 2016 Dear *The New York Times* newsroom and information security staff, On December 15, 2016, nytimes.com published a new tips page <https://www.nytimes.com/newsgraphics/2016/news-tips/> that offers individuals who want to blow the whistle on newsworthy issues ways to do so without risking their security and privacy. There is no question that this commendable decision, taken by a newspaper of record, is a significant asset towards a more effective free press. *The New York Times* makes itself available to tipsters via cutting-edge privacy technologies such as *SecureDrop* <https://securedrop.org> and *Signal* <https://whispersystems.org>. *SecureDrop* has been deployed in many of the world's most important newsrooms and has almost certainly aided in the publication of the most ethically significant leaks of this decade. *Signal*'s parent company, *Open Whisper Systems*, has indirectly allowed more than a billion people access to indisputably strong encryption. Cryptocat's own development was strongly influenced, and has influenced, these tools: we adopted a variant of *Signal*'s encryption protocol in March 2016, which was clearly superior to our own, and our early research on client-side web encryption in 2011 set the stage for *SecureDrop* and *Mailvelope* (another recommended tool) to follow in using similar engineering fundamentals, oftentimes by learning through our own early engineering mistakes and thereby avoiding them. Cryptocat was also funded by the same primary backer as *SecureDrop*, *Signal* and *Mailvelope*: the *Open Technology Fund* <https://www.opentech.fund>, an institution financed by public U.S. taxpayer dollars which supports independent efforts towards a more secure and private Internet. As a side-note, Cryptocat was even featured <http://www.nytimes.com/2012/04/18/nyregion/nadim-kobeissi-creator-of-a-secu…> in a *The New York Times* article back when it (and myself) were quite young and starting up. Cryptocat does not offer the services of either *Signal* or *SecureDrop*: it does not run on mobile devices and its user experience is not directly focused on the anonymous leaking of documents. Cryptocat is desktop software that offers a service similar to *Google Talk* or *Yahoo Messenger*: desktop chat with the ability to send large files, video messages, and offline messages. Unlike those services, Cryptocat couples these features with strong encryption, support for multiple devices and advanced security features <https://crypto.cat/security.html> such as certificate pinning, forward secrecy and future secrecy. When you use Cryptocat, the aim is that we cannot ever decipher the messages and files you communicate. However, *The New York Times*'s tips page also recommends a third tool, *PGP* <http://openpgp.org/>, implemented through the *Mailvelope* browser extension, which allows users to send encrypted emails to *The New York Times*. The goal is of letter is to petition for Cryptocat's inclusion instead of *PGP*. *PGP* does not offer a standard of security that merits its inclusion, while Cryptocat does provide a clearly higher standard of security and privacy than *PGP* when used under the same use-case. Here is the reasoning behind this claim: Cryptocat vs. PGP: On History It is best to start with the obvious: in the case that Cryptocat was ever considered by *The New York Times* for their tips page, it was likely almost immediately dismissed due to its history of critical vulnerabilities in different <http://arstechnica.com/security/2013/07/bad-kitty-rooky-mistake-in-cryptoca…> aspects <https://nakedsecurity.sophos.com/2013/07/09/anatomy-of-a-pseudorandom-numbe…> of its engineering during its early development. In 2012 and 2013, Cryptocat fell to regrettable lapses in engineering practices that led to a well-deserved weakening of its reputation. Cryptocat clearly failed its users on multiple occasions, and for the past three years, I have been deeply sorry and regretful for these mistakes and I have dedicated all the effort that is within my capacity to mitigating them and preventing them in the future. Nevertheless, every time these vulnerabilities were reported, Cryptocat responded with full disclosure, immediately issuing security updates and publicly thanking and crediting the security researchers responsible for their discovery. *PGP*, on the other hand, is a well-studied protocol, owing largely to its initial release in 1991, a clean two decades before Cryptocat's inception. The *PGP* protocol's maturity notwithstanding, it should be noted that *Mailvelope* is actually younger than Cryptocat and still uses some of the engineering practices that Cryptocat was often criticized for, such as working inside the web browser and even going further than Cryptocat ever did, by injecting code into web pages that it does not control. Cryptocat recognized these engineering practices as fundamentally unsafe and completely moved away from them in its rewrite this year as a pure desktop application. The truth is that since its complete rewrite in March 2016, Cryptocat has simply adopted engineering fundamentals that are known to be undoubtedly safer than those used by *Mailvelope*, and has been able to integrate encryption technologies that the ossified *PGP* protocol cannot hope to accomplish. Furthermore, Cryptocat's new rewrite as a desktop application was undergone during my graduate studies, in an environment where I had the resources to produce dependable software. Cryptocat's rewrite was in fact largely informed by the research I participated in for an upcoming academic publication (*Automated Verification for Secure Messaging Protocols and their Implementations: A Symbolic and Computational Approach*) that studies secure messaging in detail. This is a stark difference from the first Cryptocat, which was developed as one of my very first programming projects when I was twenty years old. Judging the new Cryptocat desktop application on the basis of the older Cryptocat browser extension is as legitimate as judging a *Boeing 747* on the basis of the performance of the Wright Brothers' first functioning aeroplane. This sort of comparison must not be the benchmark with which security software is evaluated. It is true that *PGP* remains more aged than Cryptocat. But we are not in the business of fine wine here; *Signal*, *SecureDrop* and any other tool worth using is not only younger than *PGP* but younger than Cryptocat itself. We should judge based on engineering merit, not on age. And when past reputation is concerned, I believe that Cryptocat has honestly done the work to obtain full merit for its excellence in moving past its early blunders into dependable software. Cryptocat vs. PGP: On Cryptographic Security In *PGP*, all emails ever sent by a tipster are encrypted with one single private key, which is kept indefinitely on the user's computer. This private key can only be changed or reset via a manual and relatively obscure process. Whenever this is done, the user's new public key must be communicated manually to all of its contacts. If this single private key is ever compromised, all of that user's prior communications, emails and attachments are forever compromised. If a user wants to use their same *PGP* identity on multiple devices, the compromise of one device compromises all of their past communications from all of their devices. In *"What's the Matter with PGP?"* <https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/>, Matthew Green writes: “For all the good *PGP* has done in the past, it’s a model of email encryption that’s fundamentally broken. It’s time for *PGP* to die. [...] A *PGP* critic is just a *PGP* user who’s actually used the software for a while. At this point so much potential in this area and so many opportunities to do better. It’s time for us to adopt those ideas and stop looking backwards.” Cryptocat is cryptographically superior to *PGP* in almost every respect: - *No Long-Term Encryption Key*: By basing its cryptography on the innovative *Double Ratchet* <https://whispersystems.org/docs/specifications/doubleratchet/> algorithm, Cryptocat's chat encryption <https://crypto.cat/security.html> generates a fresh encryption key for every message. The theft of a device therefore only compromises the last small handful of messages, and only allows the user to impersonate the victim's device until that key is disassociated from the user's account. - *Forward and Future Secrecy*: If, at any point, the state of the encryption keys for a conversation is compromised, the conversation's security will *self-heal* with fresh key material, preventing the compromise of any past or future messages. - *Multi-Device Support*: Cryptocat supports linking multiple devices to a user's account through its implementation of the OMEMO <https://conversations.im/omemo/> standard. Cryptocat extends this to allow recipients to authenticate contacts on a per-device basis and to see which device was used to send a particular message. If a device's identity keys are stolen, only that device may be impersonated, and the owner may unlink it from their Cryptocat account using any other device. To be clear, no one is claiming that Cryptocat is invincible. But all empirical analysis of the current cryptographic protocol indicates that it stands a better chance than *PGP* in terms of surviving a compromise or an active attacker. Cryptocat vs. PGP: On Metadata Let's assume a scenario in which someone is listening on the tipster's Internet connection. If the tipster uses PGP, the following information will be leaked: - *Email Address*: The tipster will need to sign up for an email account. This is more likely than not to be a semi-permanent indentifer, since obtaining an email account without some kind of SMS verification is becoming increasingly restricted by major providers such as Gmail and Microsoft. The email service provider will then log IP addresses used to log into that email, which email addresses sent tips to a *The New York Times* email address, and more. If the tipster uses their regular email address, they are almost certainly in trouble. - *Key Metadata*: *PGP* keys carry a significant amount of metadata, including the *PGP* version used to encrypt the message, the date the key was created, and much more. In order to correctly authenticate a *PGP* key, more identifying information might have to exist in order to convincingly correlate a key to an owner. With Cryptocat, users can create <https://crypto.cat/create> random, one-time-use usernames without needing to provide a phone number or email address, or anything really. The only metadata the Cryptocat server sees is that a random username was used to send a message to *The New York Times*'s account. The Cryptocat server does not retain any other information, including account creation time, IP addresses used to login, or anything else. Someone spying on the tipster's network will only be able to see that the tipster at some point used Cryptocat, but cannot identify which username the tipster used, or with whom the tipster communicated. Once the tip is communicated, Cryptocat users may choose to delete their account <https://crypto.cat/help.html#deleteAccount>, which completely erases any trace of the account on Cryptocat's servers. Once again, the hard, concrete facts indicate that Cryptocat is superior to *PGP* in terms of metadata. However, it should still be noted that Cryptocat, *PGP* and the other softare recommended by *The New York Times* still leak substantially more metadata than *SecureDrop*: tipsters with a strong metadata-related concern should consider using *SecureDrop* instead. Cryptocat vs. PGP: On Usability *PGP* is notorious for how painful it is to use. Cryptographers almost unanimously consider its usability to be the source of mistakes that can jeopardize user security within the first email they attempt to send. Aside from Matthew Green's above-quoted post on *PGP*, *Signal*'s original programmer also had this <https://moxie.org/blog/gpg-and-me/> to say: When I receive a *PGP* encrypted email from a stranger, though, I immediately get the feeling that I don’t want to read it. [...] *PGP* is a technology dead end [...] In the 1990s, I was excited about the future, and I dreamed of a world where everyone would install *PGP*. Now I’m still excited about the future, but I dream of a world where I can uninstall it. When using *PGP*, users must manually set up email clients and *PGP* plugins, all of varying degrees of quality and dependability. They must sign up with an email provider that might not respect their rights to privacy. They must manually generate *PGP* key pairs and communicate them to their third party, or upload them to a "key server" for out-of-band authentication. Finally, they must manually download and import the recipient's public key. In comparison, using Cryptocat involves downloading the client, signing up, registering your device, adding your recipient as a buddy and sending a message (after optionally verifying their device list via a friendly user interface). Unlike *PGP*, the workflow is almost exactly similar to that of popular applications such as *Skype*, therefore, there is crucially less room for the user to make a mistake. Aside from having less room for failure, Cryptocat also simply offers more features: support for multiple devices, each with a separate identity. Online and offline messaging. File sharing with file sizes of up to 200MB, which is far beyond what email attachments allow. And while this might be less useful for tipsters, Cryptocat also allows users to record video messages right from within their chat window. Cryptocat: Not Perfect but the Clear Better Choice All software will have bugs. No solution is bulletproof. All of the tools currently mentioned on the tips page of *The New York Times* has had vulnerabilities of varying severity, and security updates are, therefore, a fact of life for any software that we use and that matters. However, when we dare to discern, when we judge based on fact and science, we can clearly understand that Cryptocat is a better choice than *PGP*. In line with the Cryptocat Mission Statement <https://crypto.cat/mission.html>, Cryptocat will strive to be dependable software that deserves to be the conduit between some of the world's best journalists and stories that might change our lives. I ask the staff at *The New York Times*, with the most sincere good faith and the most serious intent to replace *PGP* with Cryptocat. Over its six years of development, it has matured into dependable software. It is the better choice. * Signed, Nadim Kobeissi <https://nadim.computer> Cryptocat software programmer https://crypto.cat/news.html#nytltr <https://crypto.cat/news.html#nytltr>*

2 1

33C3 Behind The Scenes: Shadows Of TorGate Roam
by booty 05 Jan '17

05 Jan '17

> The Case (Translations): > [Applebaum] has opened her pants and seized her vagina grabbed her by the pussy > final boss Shari Steele lol

2 1

"right" vs permission, to immigrate - "Japan: No Muslims, no terrorists"
by Zenaan Harkness 05 Jan '17

05 Jan '17

I've heard at least one "libertarian utopian" position that movement of humans, i.e. emmigration and immigration, ought be by the free will of the individual human(s). Japan is a useful information point in this debate, and the following article lays out the Japanese experience with respect to immigration to Japan, and in particular, Japan's treatment of Islamic immigration to Japan. In an era where many in the West proudly proclaim that race and cultural heritage are nothing but social constructs, Japan provides a compelling counter point to what some might term "neo-liberal hogwash". In the past, attempts to engage this particular discussion come up pretty short, with flippant rejection of the 'cultural desires' of large portions of the population of many countries; certainly we live in interesting times.. Japan: No Muslims, no terrorists https://www.onenewsnow.com/perspectives/bryan-fischer/2016/01/04/japan-no-m… There is a simple reason we never read about jihadi attacks in Japan. There are no Muslims there. No Muslims, no terrorists. This is a significant data point in the public debate over Muslim immigration. Donald Trump, of course, has famously proposed a suspension of Islamic immigration until we can figure out a way to screen out jihadis, and Franklin Graham is backing that suggestion to the hilt. The primary God-given role of government is to keep us safe. According to Romans 13, this involves the use of lethal force, when necessary, to administer justice and to protect our national security. The number-one fear today among the American people is a Muslim terror attack. It is our government's chief responsibility to enact whatever public policies are necessary to reduce that fear and eliminate the threat. This means there is much we can learn from Japan, which has been virtually free from Islamic unrest. Simple demographics tell the story. Dr. Mordechai Kedar, writing in The Jewish Press, offers some of the details (emphasis mine throughout): This country keeps a very low profile on all levels regarding the Muslim matter: On the diplomatic level, senior political figures from Islamic countries almost never visit Japan, and Japanese leaders rarely visit Muslim countries. The relations with Muslim countries are based on concerns such as oil and gas, which Japan imports from some Muslim countries. The official policy of Japan is not to give citizenship to Muslims who come to Japan, and even permits for permanent residency are given sparingly to Muslims. Japan is a nation of roughly 126 million people. And yet, according to Dr. Kedar, there are only 10,000 Muslims in the entire country. This represents less than one hundredth of one percent. (Other estimates are higher, but none suggest a number above 100,000.) Muslim immigration is officially and culturally discouraged, and a Japanese woman who marries a Muslim man becomes a social outcast. Contrast this with many European nations who have allowed Muslims with their death-to-the-West ideology to reach 5 to 10 percent of their populations. In France, authorities were relieved disaffected Muslim teenagers only torched 804 cars on New Year's Eve, down from over 900 the year before. These young devotees of the religion of peace also managed to blow up a public Christmas tree in between firebombing automobiles, and the mere threat of a Muslim terror attack shut down a huge fireworks display in Brussels. Islamic proselytization is forbidden in Japan, it is very difficult to import Qur'ans into the country, and there are very few mosques. In Japan, Muslim men are expected to pray at home, not in mosques or in the middle of the street as they do in France. Islamic organizations are not allowed, so the Japanese do not have to deal with the incessant stream of propaganda coming from pro-jihadi groups like CAIR. There is only one imam in Tokyo, a city of over 13 million people. Virtually the only Muslims who are in Japan come as employees of foreign companies. And even that is the exception rather than the rule. "The official policy of the Japanese authorities is to make every effort not to allow entry to Muslims, even if they are physicians, engineers and managers sent by foreign companies that are active in the region." The Japanese have a patriotic pride in Japanese exceptionalism, Japanese culture and Japanese traditions, and instinctively recognize that enculturating Islam threatens all that because its value system is so antithetical to what makes Japan Japan. The resistance to Islamic infiltration is universally shared by the populace at large. "Japan manages to remain a country almost without a Muslim presence because Japan's negative attitude toward Islam and Muslims pervades every level of the population, from the man in the street to organizations and companies to senior officialdom." What's more, because the Japanese are proud of who and what they are, and because of their allegiance to their own cultural values, they are utterly unapologetic about their resistance to Islam. "The most interesting thing in Japan's approach to Islam is the fact that the Japanese do not feel the need to apologize to Muslims for the negative way in which they relate to Islam." Geert Wilders, the Dutch Parliamentarian who has led the worldwide effort to tell the truth about Islam, has said that Western nations must rediscover the vast superiority of Christian civilization over Islamic civilization, and take a justifiable pride in the Christian heritage of their own country before they are swept beneath the waves of the Muslim tsunami now sweeping over Europe and America. Concluded Dr. Kedar, "Japan is teaching the whole world an interesting lesson: there is a direct correlation between national heritage and permission to immigrate: a people that has a solid and clear national heritage and identity will not allow the unemployed of the world to enter its country; and a people whose cultural heritage and national identity is weak and fragile, has no defense mechanisms to prevent a foreign culture from penetrating into its country and its land." Taking humble and grateful pride once again in what God has done to make America the most exceptional nation in history is not only the right thing to do, it is the safest thing to do. -- * Certified Deplorable Neo-Nazi Fake News Hunter (TM)(C)(R) * Executive Director of Triggers, Ministry of Winning * Weapons against traditional \/\/European\/\/ values: http://davidduke.com/jewish-professor-boasts-of-jewish-pornography-used-as-… * How Liberal Lefties view the world: http://bbs.dailystormer.com/uploads/default/optimized/3X/0/4/042cb95724339d…

11 40

FBI at least partially owned
by Georgi Guninski 05 Jan '17

05 Jan '17

FBI at least partially owned http://www.theregister.co.uk/2017/01/05/hacker_claims_fbi_cms_zero_day_hack… Hacker claims FBI CMS zero day hack, dumps 155 purported logins

1 0

33C3 Behind The Scenes: Shadows Of TorGate Roam
by grarpamp 05 Jan '17

05 Jan '17

# The case: About Justice http://www.taz.de/!5361578/ http://pastebin.com/4zhW6N7m https://translate.google.com/translate?sl=de&tl=en&js=n&hl=en&ie=UTF-8&u=ht… with comments And other related streams for journos... https://twitter.com/search?q=torgate https://twitter.com/search?q=jakegate https://twitter.com/search?q=ioerror https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/master/JacobAppelba… https://events.ccc.de/2016/11/22/hello-this-is-33c3-works-for-me/

1 0

NZ Journo Dawson Seeks RU Asylum
by grarpamp 05 Jan '17

05 Jan '17

http://wearechange.org/wrc-journalist-applied-asylum-russia/ She is one of the most accomplished independent New Zealand journalists on the international stage, but most New Zealanders have never heard of her. We Are Change investigative reporter Suzie Dawson is a renowned journalist whose work has been recommended by a Pulitzer Prize winner, Hollywood celebrities and WikiLeaks. She is presently living in Russia, awaiting a decision on her application for temporary asylum. Dawson has written for a number of American and European mainstream and alternative media outlets over the years and her photos, videos and social media commentary has been featured in dozens of others. She may be the first NZ journalist ever to seek asylum—certainly the first to do so in Russia—yet despite her having been amplified by countless media organizations and public figures like WikiLeaks, Kim Dotcom, Russell Brand, Glenn Greenwald, John Cusack, Roseanne Barr, Bianca Jagger and more, media in New Zealand have so far completely ignored her achievements, her persecution by intelligence agencies opposed to her work and her plea for asylum in Russia. By all appearances, New Zealand media have been complicit in a full blackout on her entire situation. ...

1 0

Assange via Hannity: Staring Down False Media and Govt Games
by grarpamp 05 Jan '17

05 Jan '17

Hannity Interviews Assange 1/7/17 https://www.youtube.com/watch?v=Dg6gu3qY7rA Hannity Interviews Assange 12/15/16 https://www.youtube.com/watch?v=6R-D1fvMtbk Hannity Interviews Assange 9/6/16 https://www.youtube.com/watch?v=it2W_6NfT-E Sarah Palin - "I apologize" to Julian https://www.facebook.com/photo.php?fbid=10154916952353588 https://twitter.com/SarahPalinUSA/status/816494925156126720 https://twitter.com/SarahPalinUSA/status/816495516339073024 Trump - Echoes Julian https://twitter.com/realDonaldTrump/status/816632793862176769 Remains to be seen who tweets Assange after Inaguration. And if Power beginning to bow to random threat of leaked Truth. https://file.wikileaks.org/torrent/2016-12-09_WL-Insurance.aes256.torrent SHA256:637f6996be1ea0155099df79baf7b7e7be14d17965026f619acf139f9fd55382 https://file.wikileaks.org/torrent/2016-11-07_WL-Insurance_EC.aes256.torrent https://file.wikileaks.org/torrent/2016-11-07_WL-Insurance_UK.aes256.torrent https://file.wikileaks.org/torrent/2016-11-07_WL-Insurance_US.aes256.torrent https://file.wikileaks.org/torrent/2016-06-03_insurance.aes256.torrent https://file.wikileaks.org/torrent/wlinsurance-20130815-A.aes256.torrent https://file.wikileaks.org/torrent/wlinsurance-20130815-B.aes256.torrent https://file.wikileaks.org/torrent/wlinsurance-20130815-C.aes256.torrent https://file.wikileaks.org/torrent/wikileaks-insurance-20120222.tar.bz2.aes…

2 1

population growth vs GDP per capita and the myth of "immigrate muh tax payers" - Japan debunks the bull
by Zenaan Harkness 04 Jan '17

04 Jan '17

Japan, as always, leads the way in common sense on this immigration issue. The crux is this: to the fractional reserve banking system, GDP is a relevant figure. To individuals, the only relevant figure is GDP per capita. Well duh! And in real life, across countries, "there is absolutely no correlation between population growth and GDP per capita" in the OECD countries. "GDP does not depend on a growing population, and there is virtually no relation" between them. Why Japan Refuses Immigration and Multiculturalism http://www.dailystormer.com/why-japan-refuses-immigration-and-multicultural… direct youtube: http://www.youtube.com/watch?v=Z3BYCK-3jPc

1 0