- cypherpunks - lists.cpunks.org

TOR Project: Still coming unwrapped
by Steve Kinney 18 Aug '16

18 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Holy F Society, the TOR Project just came unwrapped. MORE. This essay keeps getting more outrageous, without losing credibility, until it turns a corner that "network security" people could easily attribute to hostile tradecraft. https://shiromarieke.github.io/tor -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXtUn5AAoJEECU6c5XzmuqHbQH/182mmOyXQsN6MigrmS4WhI4 xxVoNJoXwt1DBctCMC1eMq1o/nCCbicIeXwMMztzdmKQ9GReWzXrTW8hNjy7R4rR +JpUarD4xw5wRwllg4RD4QsBuu+RJp1c/Tyo+GZX49TmYeYk80Chgnfu3zoH2+nw SCftTWIZdlheUbY4GYnHUVWOkJaASvPz/ibZIRs5J6rIx4FPkqiuCckRkILJ7FXs ZzmepzzPY7cAnuW2Zm+kdkkACGnMUfYTdp4vM3pXLu8b4zfOpeRe5JxPVoapOF3P kDrJbDCyHnIDCsYOAeg1pPg3dlQAktN/FBqzQTS3UbaBq+NUJ47o1XvmyzGmZIs= =e8hU -----END PGP SIGNATURE-----

3 3

Riffle: an efficient communication system with strong anonymity
by grarpamp 17 Aug '16

17 Aug '16

http://news.mit.edu/2016/stay-anonymous-online-0711 https://dspace.mit.edu/handle/1721.1/99859 https://people.csail.mit.edu/devadas/pubs/riffle.pdf https://dspace.mit.edu/bitstream/handle/1721.1/99859/927718269-MIT.pdf

9 14

Is it fun owning augmented reality? Internet of Things?
by Georgi Guninski 17 Aug '16

17 Aug '16

Is it fun owning augmented reality? Or the Internet of Things? Any 'real reality' damages? http://www.ibtimes.co.uk/pokemon-go-security-flaw-enables-hacker-take-over-… Pokemon Go security flaw enables hacker to take over gyms in London and New York using eggs

1 0

Hedge fund manager profited from death arbitrage.
by jim bell 17 Aug '16

17 Aug '16

https://www.bloomberg.com/view/articles/2016-08-16/hedge-fund-manager-profi… "A vital function of the financial system is to shift risk, but that is mostly a euphemism. Finance can't make risks go away, or even really move them all that much. When the financial system shifts the risk of X happening from Y to Z, all that means is that Z gives Y money if X happens. If X was going to happen to Y, it's still going to happen to Y. But now Y gets money. Death is a central fact of human existence, the fundamental datum that gives meaning to life, but it is also a risk -- you never know when it will happen! -- and so the financial industry has figured out ways to shift it. Not in any supernatural sense, I mean, but in the regular financial-industry sense: by giving people money when death happens to them. One cannot know for certain how much of a consolation that is.""Another vital function of the financial system is to brutally punish the mispricing of risk through arbitrage. Actually I don't really know how vital that one is, but people are pretty into it. If someone under- or overestimates a risk, someone else will find a way to make them pay for it. That's how markets, even the market for death, stay efficient.""The normal way to shift the risk of death is life insurance -- you die, the insurance company gives you money -- but there are other, more esoteric versions, and they are more susceptible to arbitrage.One version involves "medium and long-term bonds and certificates of deposit ('CDs') that contain 'survivor options' or 'death puts.'" Schematically, the idea is that a financial institution issues a bond that pays back $100 when it matures in 2040 or whatever. But if the buyer of the bond dies, he gets his $100 back immediately, instead of having to wait until 2040. He's still dead, though."[end of partial quote] AP ('Assassination Politics'; https://cryptome.org/ap.htm ) can be considered to be 'death arbitrage' with a few key differences: The person who will die isn't part of the agreement, and doesn't profit when the initial deal is struck, nor later. Jim Bell

4 5

Weed, USPS, Tor... cypherpunk [was: Tor Browser]
by grarpamp 17 Aug '16

17 Aug '16

On 8/16/16, John Newman <jnn(a)synfin.org> wrote: > Awful lot of dope makes its way through USPS, with TOR as the medium for > setting up delivery, every day all day... Just log in to alphabay and browse > around ... ;) > > But, who knows how long they'll last, there might be sealed indictments > already... Great thing is... this is all testing a whole lot of new ground. >From anonymous overlay networks, delivery / drop models, comms tools, law enforcement, crypto, law itself, politics, leaks, hacking the IoT, privacy, etc... And it's getting faster, you only have to wait a few years to get a rough early status of each new iteration. Overall, it's exactly what should happen, and it's been a long time coming. PGP, 2600, and mixmaster were just some of the first forays, There's so much more to come, and to be done... be it for the world, or even just the peace pipe at 4:20.

2 1

Fwd: [liberationtech] Tor Browser 6.0.4 is ready for testing
by Cecilia Tanaka 17 Aug '16

17 Aug '16

Uff... Some months ago, I would be happy. Now, it means nothing... :(( ---------- Forwarded message ---------- From: "Yosem Companys" <companys(a)stanford.edu> Date: Aug 15, 2016 12:10 PM Subject: [liberationtech] Tor Browser 6.0.4 is ready for testing To: "Liberation Technologies" <liberationtech(a)lists.stanford.edu> Cc: "Georg Koppen" <gk(a)torproject.org> From: Georg Koppen <gk(a)torproject.org> Hi all, We are pleased to accounce that Tor Browser 6.0.4 is ready for testing. Bundles can be found on: https://people.torproject.org/~boklm/builds/6.0.4-build2/ This release finally brings Tor Browser users the latest Tor stable, 0.2.8.6, and avoids pinging Mozilla servers for system extensions. The latter was responsible for users getting an extension into their Tor Browser that resulted in annoying and confusing "Your Firefox is out of date" notifications on start-up (bug 19890). Thanks to Mozilla engineers who fixed that issue as fast as possible on their side: the extension is not shipped to Tor Browser users anymore if they ping Mozilla's server. Users that are on the alpha channel or are using the hardened Tor Browser were not affected. The same goes for Tails users as far as we know. The full changelog since Tor Browser 6.0.3 is: Tor Browser 6.0.4 -- August 16 * All Platforms * Update Tor to 0.2.8.6 * Update NoScript to 2.9.0.14 * Bug 19890: Disable installation of system addons Georg -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/ mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

6 14

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

US drug policy -> maintains the class divide
by Zenaan Harkness 16 Aug '16

16 Aug '16

>From a comment on slashdot - I'm not American, but this sounds quite plausible to me: http://news.slashdot.org/story/15/11/27/1343243/lsd-microdosing-gaining-pop… " If you're a $100k/yr engineer (Score:4, Insightful) by rsilvergun (571051) on Friday November 27, 2015 @10:52AM (#51013395) such things don't apply. In America we have a multi-tiered justice system. It's pretty well documented. Wealthy and educated people get treatment programs, while poor (and let's face it, black) people get jail. It's because what we're really using our drug policy for is to keep the poors in check. Think of it this way. If your poor chances are you or one of your friends is using drugs to cope with poverty. Now, our drug laws, in particular our asset forfeiture laws are basically guilt by association. Combine that with juries that are inherently conservative (since you generally have to be well off to be able to afford to server on a jury for any length of time). So when poor people show up in wealthy neighborhoods they not only stick out like a swore thumb, but odds are good the cops can bust them for the drugs at least one of them is carrying. This keeps poor people out of wealthy school districts and parks, and lets the wealthy enjoy their (much, much better) public services. Basically, our drug policy is central to maintaining our class divide... "

3 3

Exchange / Trading / Analysis Software [re: Zenbot3 BTC/ETH/LTC bot]
by grarpamp 16 Aug '16

16 Aug '16

On 8/16/16, Carlos Rodriguez <carlos(a)s8f.org> wrote: > zenbot is an automated cryptocurrency trading bot. It runs on node.js and > MongoDB and is fully open-sourced. A plugin architecture is included that > allows any exchange, trade strategy, or currency pair to be supported. > > • Default support for GDAX is included, so if you have a GDAX account, > • Default support for other exchanges is ongoing. > instead of trading on GDAX, you could trade on a different exchange > > More: https://s8f.org/zenbot.html https://github.com/carlos8f/zenbot As far as opensource goes... - There's the above sort of thing on the user side that interfaces with an existing exchange to place orders, etc. - There are some tradedesk like things for analysis of market feeds and history from an exchange. Those two are sometimes blended together in one tool. Then the third component is... What software is out there that implements an exchange itself? Be it for currency pairs, stocks, or commodity trade floor. Currency pairs being the primary example above. List software for centralized models... List software for distributed models... Note that a distributed "marketplace" where users buy and sell "things", is not really an exchange engine itself, though it may serve similar end purpose. Whereas an ethereum program might be considered a true engine, an API, perhaps collecting, advertising and executing buy / sell orders, without need for user to see or deal individually with all the other users making up the liquidity.

1 0

[liberationtech] Tor Browser 6.0.4 is ready for testing
by vroom＠mail2tor.com 16 Aug '16

16 Aug '16

> Rayzer: > run off thumbdrive > leave no trace > wipes memory This incorrect. Such system write over data. Trace on *all* flash. Can be recovered. Read hacks.

3 2