- cypherpunks - lists.cpunks.org

Re: [cryptography] To Protect and Infect Slides
by Jacob Appelbaum 08 Jan '14

08 Jan '14

Kevin W. Wall: > On Tue, Dec 31, 2013 at 3:10 PM, John Young <jya(a)pipeline.com> wrote: > >> 30c3 slides from Jacob Appelbaum: >> >> http://cryptome.org/2013/12/appelbaum-30c3.pdf (3.8MB) >> > > And you can find his actual prez here: > <https://www.youtube.com/watch?v=b0w36GAyZIA> > > Worth the hour, although I'm sure your blood > pressure will go up a few points. > I'm also happy to answer questions in discussion form about the content of the talk and so on. I believe we've now released quite a lot of useful information that is deeply in the public interest. All the best, Jacob

5 7

Private Distributed Hash Tables
by Rich Jones 08 Jan '14

08 Jan '14

Far too much yap yap yappin' around here lately.. cpunks write code, remember? Let's get back to business. Here's an idea for a private, censorship-resistant communication/file sharing system with integrated invitations and access control. I don't think I've ever seen this before, but it's quite possible that people have discussed this idea previously. Either way, I don't know of any implementations yet. Problem ======= The current P2P file sharing landscape is divided up into two spaces: 1) private tracker communities (what.cd // Demonoid // etc) which provide high quality network speeds and file quality through moderation, but which are often subject to outages due to centralization, and 2) the single giant BitTorrent 'peer exchange' distributed hash table, which provides universal file access and fault-tolerance, but at the cost of abuse and surveillance of those participating. Ideally, we want a peer-to-peer community which is decentralized and fault-tolerant, but with enough authority to maintain a high network quality and private enough to avoid open surveillance. Proposed Solution ======= It might be possible to combine the exclusivity and moderation of private trackers with the fault-tolerance of distributed hash tables by having each private table operate with a certificated-authority based public key infrastructure. Essentially, to participate in the DHT, peers must cryptographically prove that they have been invited to participate. Power and trust flow down a through a concentric certificate web. A client's authority in the network is a function of how far away from the root authority they are (not dissimilar to Scientology's hierarchy.) Clients should automatically respect commands coming from those higher up the cert chain or from those closer to the root than they are, and should listen to, but not automatically respect, commands from those lower down the cert chain or from "lower-ranking" clients. * Bootstrapping and Invitation The very first user of the network will have to generate a root certificate. He is then able to generate new signing certificates, which he can give to new users of a network to allow them the ability to access the network. These new users should be able to use their own certificates to do the same for their own new users. (This could be done with certificate signing requests coming from potential new users as well, but that might come at the cost of a slightly more complicated user experience). * Revocation Bannings can be performed by issuing updates to a network-wide revocation list. Clients will automatically respect revocations coming from superiors, and may or may not choose to respect revocations coming from underlings. * Implementation Everything needed to create the heart of this should exist already in Kademlia and OpenSSL. BitTorrent could serve as the basis for the file-sharing application, but vanilla BitTorrent has a content discovery problem, so I'd suggest that any implementations of BitTorrent on Private Distributed Hash Tables should have some kind of discovery BEP included as well, possibly one which uses the authority system of the PDHT to verify files. There's also a possibility there for what you might call "trusted amnesia" - the ability for a user with a high authority to publish verified documents to the whole network without having to broadly expose themselves as the source of the content by having peers in their same trust level sign their content, forget the source, then increase the availability by one access level. Anyway, that's the sketch. Any thoughts? Rich

2 3

Stealing J. Edgar Hoover's secrets.
by Jim Bell 07 Jan '14

07 Jan '14

Just saw this on Yahoo. Seems appropriate to mention this, given Snowden, Manning, etc. http://screen.yahoo.com/new-york-times/stealing-j-edgar-hoover-secrets-1309…

2 1

Swartz, Weev & radical libertarian lexicon (Re: Jacob Appelbaum in Germany - Aaron Swartz)
by Jim Bell 07 Jan '14

07 Jan '14

From: Cari Machet <carimachet(a)gmail.com> To: rysiek <rysiek(a)hackerspace.pl> Cc: cypherpunks(a)cpunks.org Sent: Tuesday, January 7, 2014 10:29 AM Subject: Re: Swartz, Weev & radical libertarian lexicon (Re: Jacob Appelbaum in Germany - Aaron Swartz) On 1/7/14, Adam Back <adam(a)cypherspace.org> wrote: [deletia] >>took it to the next level including >> physical >> intrusion & hiding equipment. But MIT (and to a lesser extent JSTOR) let >> him down badly as did some of his academic friends and its tragic that he >> was a victim of some extremely over reaching imbalanced law the CFAA [3], >> aggressively prosecuted by self-agrandizing politically motivated, and >> almost legally immune deeply flawed US federal prosecution and plea bargain >> system, >yes but i think from my understanding it wasnt the amount of prison >time or the money but the fact that he wld have to plead guilty to 13 >felony counts - he would not get to serve in the government ... vote >etc From personal experience, I can shed light on the issue of voting as a felon. Contrary to what many people seem to think, most states seem to allow 'felons' to vote, eventually. (Some while they are in jail or prison; some immediately when they are released; some when they are off parole.) In my own case, the state of Washington's Constitution says that only felons guilty of "infamous crimes" lose their right to vote, and Washington state law defines an "infamous crime" as a crime punishable by one or more years incarceration in the _state_ penitentiary. Since my 'crime' was Federal, not state, it did not satisfy this condition, so I was not even prohibited from voting while I was in prison. (Though I never tried to vote while I was in prison; And, though, I did not learn that they didn't understand this fact until my release in late December 2009). I sent many emails to the Secretary of State of Washington stating this obvious position in early 2010, and they responded by repeatedly stating the contrary, commonly-thought position. They were never able to openly acknowledge I was right, although by my release from prison in March 2012, I checked their website and saw that they had corrected their prior, incorrect position. Jim "Al Capone" Bell

1 0

"Digital Cash", 3rd ed.
by Robert Hettinga 07 Jan '14

07 Jan '14

Peter Wayner surfaces with a third edition of "Digital Cash”: http://www.indiegogo.com/projects/digital-cash-3rd-edition Cheers, RAH Alla the old farts are crawlin’ outta the woodwork, um, aren’t we?

1 0

Re: Swartz, Weev & radical libertarian lexicon (Re: Jacob Appelbaum in Germany - Aaron Swartz)
by John Young 07 Jan '14

07 Jan '14

Anybody with a three-letter name of a website, or more grotesquely vain, a TLA nym, needs killing thrice as a bitter old diaper-wearing turd and tex-mexist marxian from Odessa, oil-capitalist murder capital of the USA.

3 2

NSA, FBI creep & rule of law, democracy itself (Re: [cryptography] To Protect and Infect Slides)
by Adam Back 07 Jan '14

07 Jan '14

This is indeed an interesting and scary question: On Sun, Jan 05, 2014 at 08:31:42PM +0300, ianG wrote: >What is a game changer is the relationship between the NSA and the >other USA civilian agencies. The breach of the civil/military line >is the one thing that has sent the fear level rocketing sky high, as >there is a widespread suspicion that the civil agencies cannot be >trusted to keep their fingers out of the pie. AKA systemic >corruption. If allied to national sigint capabilities, we're in a >world of pain. > >Question: Is there anything that can put some meat&metrics on how >developed and advanced this relationship is, how far the poison has >spread? How afraid should people in America be? maybe the most interesting and portenteous shift in power towards Orwellianism and totalitarianism in a century, as it affects the effectiveness of rule of law, and already weak separation of politics from law enforcement and justice system in the (current though slipping) super-power with unfortunate aspirations of extra-territorialism and international bullying. We're still a few decades from the cross over of financial dominance to Asia and BRICs, and most of those places are probably worse than the US by aspiration if thats possible, though less internet spying budget and capability. Unless something shapes up towards democracy in the super-power competitors we're in for a dismal century seemingly. That the NSA, and now seemingly FBI, see this I think maybe this FBI mission creep suggests the national security / law enforcement separation is slipping badly: http://news.slashdot.org/story/14/01/07/0015255/fbi-edits-mission-statement… | "Following the 9/11 attacks, the FBI picked up scores of new | responsibilities related to terrorism and counterintelligence while | maintaining a finite amount of resources. What's not in question is that | government agencies tend to benefit in numerous ways when considered | critical to national security as opposed to law enforcement. 'If you tie | yourself to national security, you get funding and you get exemptions on | disclosure cases,' said McClanahan. 'You get all the wonderful arguments | about how if you don't get your way, buildings will blow up and the | country will be less safe.'" so if even the FBI are getting their nose into the tent of unfetter access to historical data on everyone, plus informal channels and "tip-offs" on dirt on politically unpopular pepople - eg say effective security researchers like Applebaum, or effective journalists like Greenwald. (No "foreigners" dont feel very comforted, and the explict acknowledgment of tip-offs, and inforation channels to US domestic and international law enforcement, basically puts the entire planet at risk of politicaly motivated interference.) With retroactive search of your entire lifes electronic foot print including every "encrypted" IM, skype voip channel, contacts, emails, attorney client privileged and not, with no warrant or evidence presented to a judge for subpoena, the Orwell 2.0 system can probably fabricate or concoct trouble for 99% of the adult population of the planet. George Orwell 30 years late. We're pretty close to fucked as a civilization unless something pretty radical shifts in the political thinking and authorizations. And realistically it not even clear the NSA can politically be controlled anymore by the political system. Its very hard to influence something with that much skull-duggery built into its DNA, that many 10s of billions in outsourced defense contractor lobbying power, that much inertia and will to survive as an org, with military PSYOPs to turn on its own populace and political system, and black bag covert ops ties to dirty tricks in CIA, and judicial and law virtual immunity. They probably realistically went full speed ahead since the 11 Sep 2001, if not earlier on such things, and the scrapping. TIA wiki http://en.wikipedia.org/wiki/Total_Information_Awareness | Although the program was formally suspended [as of late 2003], its data | mining software was later adopted by other government agencies, with only | superficial changes being made. Probably even before since we nominally won the export regulation debacle and democractic countries were forced to admit it was inconsistent with their self-perception as open democratic countries, to be controlling and banning encryption software. The 21st century equivalent of book burning. Can we rectify this with the cypherpunks write code? Maybe as Schneier said in a discussion on this topic with Eben Moglen (at Moglen's respective university) maybe we can make it more expensive by deploying more crypto that is end to end secure, secure by default. ie more TOFU, more cert pinning, more certificate transparency distributed cert validation. Even the cert valiation maybe behind the game, perhaps NSA really do already have a lot of actual SSL private keys via hardware, software hacking and backdoors with manufacturer complicity or not, as well as just demanding them with NSL orders, gag orders as Lavabit showed finally with evidence. I wonder what proportion of SSL certs worldwide the five eyes/Orwell 2.0 shadow orwell 2.0 government have copies of? Adam

1 0

Re: Omidyar influence in new Greenwald venture [was: SRF: cryptic]
by John Young 07 Jan '14

07 Jan '14

GG is to be complimented for engaging on Twitter. That could be the most lasting of the outlets due to its free swarming and lack of wealth accumulation and concentration by hierarchical rewarding of the very top, commercial journalism (acknowledging the Twitter owners stealing the values of the free tweets). Tweets are only about self- and product promotion. Not like this grafitti billboard. Most of GG's statement comes right out of Silicon Valley playbook for acquiring hard-luck journalism. Use of "thrilling" is the clue the saved emit upon envisioning the IPO, which is what GG is PRing about as required of NGO beneficiaries of great wealth. The Snowden pact was superceded by the Omidyar pact. A buyout of a fledgling venture by a vulture continuing to prowl for rabbits. The vulture is the commercial components coutured by the non-profits. GG is disingenuous about the separation, as PGP was about Symantec takeover, as RSA was about EMC's. Many journalists aquired by Omidyar and Bezos have made similar statements of "irresistable" rescue by better endowed kingpins. And, yes, founders do appreciate the windfall, sign NDAs, relieve their desperate families, and move on to being celebrities, their brands prostituted to continue the windfall deal to keep quiet, to say nothing disparaging. Seymour Hersh and many others have told about their experinences with short-attention span of journalist publishers and their advertisers, TV producers, movie underwriters as fans move massively toward other markets. Edward Snowden should prepare to be royally screwed as Manning has been. This is the ancient tradition of brass sacrificing grunts for noble causes, the careers of generals and above. At 08:36 AM 1/7/2014, you wrote: >On Sun, Nov 17, 2013 at 7:02 PM, coderman <coderman(a)gmail.com> wrote: > > ... > > the Omidyar buyout of Greenwald and Poitras apparently to shield the > > willful, disgraceful corporate role in pervasive privacy destruction... > >GG refutes this premise entirely, and with conviction: > >http://utdocuments.blogspot.com.br/2014/01/email-exchange-with-reader-over-… >""" >(4) The claim that we are "holding back documents" for some nefarious >or self-interested purpose is and always has been false. I have >discussed many times before - most prominently here - why our >agreement with our source, along with related legal issues, prevents >any sort of mass release of documents, but I have been working >endlessly, as has Laura, to continue to publish stories all around the >world, including publishing many stories and documents after we formed >our new venture. > >Not only have I published new documents in Norway, Sweden, France, >Spain, and Holland after we formed our new venture, but I also >published one of the most attention-generating stories yet in the >Huffington Post just five weeks ago. Similarly, Laura has published >numerous big articles and key NSA documents in both der Spiegel and >the NYT after we formed our new venture. We're doing the exact >opposite of this accusation: we're publishing documents and stories >aggressively all over the world with other media outlets until our >First Look site is ready. > >We will continue to publish aggressively with other outlets until we >are up and running at First Look. In fact, I am working right now with >other news outlets, including in the U.S., on big stories. I'm not >"holding back" anything: of all the many entities with thousands of >Snowden documents, I have published more NSA documents, in more >nations around the world, than anyone. And there are many, many more >that will be published in the short-term. > >But - and this is critical - in his Washington Post interview with >Snowden last month, Bart Gellman noted "Snowden's insistence, to this >reporter and others, that he does not want the documents published in >bulk." From the start, Snowden indeed repeatedly insisted on that. > >Anyone who demands that we "release all documents" - or even release >large numbers in bulk - is demanding that we violate our agreement >with our source, disregard the framework we created when he gave us >the documents, jeopardize his interests in multiple ways, and subject >him to far greater legal (and other) dangers. I find that demand to be >unconscionable, and we will never, ever violate our agreement with him >no matter how many people want us to. > >That said, we have published an extraordinary number of top secret NSA >documents around the world in a short period of time. And our work is >very far from done: there are many, many more documents and stories >that we will publish. > >Toward that end, we have very carefully increased the number of >journalists and experts who are working on these documents and who >have access to them. We are now working with more experts in >cryptography and hacking than ever. One of the most exciting things >about our new organization is that we now have the resources to >process and report these documents more quickly and efficiently than >ever before, consistent with ensuring that we don't make the kinds of >errors that would allow others to attack the reporting. > >These documents are complex. Sometimes they take a good deal of >reporting to fill in some of the gaps. From the start, people have >been eager for us to make serious mistakes so they can exploit them to >discredit the reporting, and so we work very hard to make sure that >doesn't happen. That takes time. Convincing media institutions (and >their armies of risk-averse lawyers, editors and executives) to >publish documents, the aggressive way we think they need to be >published, also often takes a lot of time. > >When we began our reporting in June by publishing a new story every >day, even our allies - people who work on these issues for a living - >complained that the releases were coming too fast to process, >understand, or keep up with, and argued that each story needs time to >be processed and to allow people to react. > >In terms of effects, I think it's hard to argue with the strategy. >Even seven months later, the story continues to dominate headlines >around the world and to trigger what Chelsea Manning described in her >private chat as her goal when whistleblowing: "worldwide discussion, >debates, and reforms". That's why Edward Snowden made clear to Bart >Gellman that he "succeeded beyond plausible ambition." > >For the same reason, I'm proud that we're trying to amplify the >lessons and maximize the impact of these disclosures even more through >things like books and films, which can reach and affect audiences that >political reporting by itself never can. I've been working for many >years warning of the dangers of state surveillance and the value of >internet freedom and privacy, and am thrilled to now be able to have >those messages heard much more loudly and clearly than ever before by >using all platforms to communicate them. > >In sum, I know that we have been and continue to be extremely faithful >and loyal to the agreement we entered into with our source, and are >doing our journalism exactly as we assured him he would. As Snowden >himself has said, he thinks that, too. That continues to be a >critically important metric for me. >"""

1 0

Omidyar influence in new Greenwald venture [was: SRF: cryptic]
by coderman 07 Jan '14

07 Jan '14

On Sun, Oct 20, 2013 at 6:11 PM, coderman <coderman(a)gmail.com> wrote: > ... this should be tempered with appropriate caution: > "Six Degrees of Omidyar" > http://tomslee.net/2013/09/six-degrees-of-omidyar.html > who will surely show up in any Open Data effort making progress... also involved in: """ Glenn Greenwald, who has published many of the most important scoops from the Edward Snowden leaks, is leaving The Guardian and setting up a new media venture with long-time journalist Laura Poitras and Jeremy Scahill from The Nation. The venture is being funded by eBay founder Pierre Omidyar, who has suggested that he's prepared to invest more than $250 million in the new venture. """

4 7

Re: [cryptography] To Protect and Infect Slides
by John Young 06 Jan '14

06 Jan '14

Brian Carroll rightly expands the discussion of pervasive targeting by ubiquitous technology. In architecture, for example, the increasing use of automation for controlling building systems -- HVAC, electrical, plumbing, security among others -- poses considerable vulnerabilities beyond legacy analog controls. Many of the automated systems are administered remotely over telephone, cable and wireless networks. Others are controlled locally within structures. Some are secured with encryption but many are not. And few are TEMPEST-protected outside military and governmental facilities. We have found that few architects and building engineers are knowledgeable about building automated systems nor the variety of means to secure and protect them. They are customarily designed, operated and maintained by specialty firms not traditional building designers. Moreover we have found that building management and maintenance staff rely upon outside firms for advanced technology, thus subjecting their facilties to unsupervised interventions by outside personnel who may themselves be sub-contractors, and sub-subs for each component of automation. In short, it is fairly easy to interdict and access building automation systems for implanting devices, injecting packets, tampering with OSes, siphoning networks, temporarily suspending security, all the things recently revealed in the 30c3 presentations. Digital security and TSCM experts are familiar with many of these vulnerabilities but there is a common practice to specialize in services (often at client request) and neglect comprehensive coverage. For example, to inspect communications and security systems but not HVAC, plumbing, electrical and automation systems which often have far more inadvertent emitters and transceivers contained in extensive components throughout a structure. NSA TAO and the joint CIA-NSA Special Collection Service are especially capable to expoit these gaps, and usually send teams composed of experts in each building system to determine a comprehensive attack on vulnerabilities, and shrewdly, planting multiple and various decoys to mislead counterspies. A catalog of these full-scope operations would be quite informative and perhaps diminish the effectiveness of ruses and decoys, in particular the kind of solo operation valorized in movies, books and TV.

3 2