- cypherpunks - lists.cpunks.org

Re: [liberationtech] Google Unveils Tools to Access Web From Repressive Countries | TIME.com
by Juan Garofalo 22 Oct '13

22 Oct '13

--On Monday, October 21, 2013 10:25 AM -0700 Yosem Companys <companys(a)stanford.edu> wrote: > http://business.time.com/2013/10/21/google-digital-rebels/ > > Google Ideas, the New York City-based "think/do tank" run by the > Internet search giant, is launching several new technologies designed > to highlight hacker attacks around the world and help people in > repressive regimes access the Internet. Don't these fucking google idiots realize that they are their own parody? Or are they laughing at how stupid the 'western' and 'democratic' public is? [rest of corporative crap deleted]

1 0

list of end-to-end secure protocols, decentralized and end-to-end secure protocols [was: CryptoSeal shutters, ala: LavaBit]
by coderman 22 Oct '13

22 Oct '13

On Mon, Oct 21, 2013 at 9:08 PM, Kelly John Rose <iam(a)kjro.se> wrote: > ... > The only solution is to not have the private key itself available to you interestingly enough, it seems there is so very little analyzing this space. typical search for elligator, today, "Cited by 1" ... WTF? they will point out it's rude to bitch without a patch,... touché someone has to pay this decentralizing cost, and so far the consumer has refused. a "fun problem" to solve; good luck!

1 1

Cheney afraid of terrist h4x0rs
by Eugen Leitl 22 Oct '13

22 Oct '13

http://www.washingtonpost.com/entertainment/tv/cheney-had-heart-device-part… Cheney had heart device partially disabled to prevent a terrorist from sending a fatal shock Olivia Harris, Pool, File/Associated Press - In an interview with CBS’ ”60 Minutes,” former Vice President Dick Cheney says he once feared that terrorists could use the electrical device that had been implanted near his heart to kill him and had his doctor disable its wireless function. By Associated Press, Saturday, October 19, 1:34 AM WASHINGTON — Former Vice President Dick Cheney says he once feared that terrorists could use the electrical device that had been implanted near his heart to kill him and had his doctor disable its wireless function. Cheney has a history of heart trouble, suffering the first of five heart attacks at age 37. He underwent a heart transplant last year at age 71. In an interview with CBS’ ”60 Minutes,” Cheney says doctors replaced an implanted defibrillator near his heart in 2007. The device can detect irregular heartbeats and control them with electrical jolts. Cheney says that he and his doctor, cardiologist Jonathan Reiner, turned off the device’s wireless function in case a terrorist tried to send his heart a fatal shock. Years later, Cheney watched an episode of the Showtime series “Homeland” in which such a scenario was part of the plot. “I found it credible,” Cheney tells “60 Minutes” in a segment to be aired Sunday. “I know from the experience we had, and the necessity for adjusting my own device, that it was an accurate portrayal of what was possible.” Cheney and Reiner are promoting a book they co-authored, “Heart: An American Medical Odyssey.” In the “60 Minutes” interview, Reiner says he worried that Cheney couldn’t stand the pressure that came on Sept. 11, 2001, the day terrorists attacked the U.S. Medical tests seen that morning showed Cheney had elevated levels of potassium in his blood, a condition called hyperkalemia, which could lead to abnormal heart rhythms and cardiac arrest. Reiner says he watched news coverage of the day’s events on television and thought, “Oh, great, the vice president is going to die tonight from hyperkalemia.”

5 5

[RISKS] Risks Digest 27.56
by RISKS List Owner 21 Oct '13

21 Oct '13

RISKS-LIST: Risks-Forum Digest Monday 21 October 2013 Volume 27 : Issue 56 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/27.56.html> The current issue can be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: Harry Lewis's blog on Harvard's Gov 1310 (PGN) Dick Cheney Said He Disabled Heart Device to Avoid Terrorist Threats (Gabe Goldberg) Judge Posner recants his previous ruling on Voter ID (NYT via PGN) Virginia Voter Purge List (PGN) Ship Tracking Hack Makes Tankers Vanish from View (Suzanne Johnson) Crooks 'stole' Experian data the old-fashioned way: They bought it! (Serdar Yegulalp via Gene Wirchenko) "Is Wikipedia for Sale?" (Lauren Weinstein) NSA Surveillance: The 21st-Century Panopticon (Bruce Schneier) France summons US ambassador to answer allegations of widespread NSA surveillance (Amar Toor via Dewayne Hendricks) Americans Are Way Behind in Math, Vocabulary, and Technology (Roberto A. Ferdman via Allan Davidson) Google Unveils Technology Tools for Digital Rebels (*Time* via Lauren Weinstein) More on "online schools" fleecing taxpayers (Ed Ravin) Re: GPS map leads to border crossing and shooting (Anthony DeRobertis) Re: "We can't let the Internet become Balkanized" (Amos Shapir) "Users hit by Blue Screen, 0xC1900101 - 0x40017 error with Windows 8.1 update" (Woody Leonhard via Gene Wirchenko) "Resurrected KB 951847 'zombie' patch fixed -- but now has new problem" (Woody Leonhard via Gene Wirchenko) "Problems remain after Microsoft yanks Windows RT 8.1 update" (Woody Leonhard via Gene Wirchenko) Microsoft ``Still Working'' on KB2862330 Windows 7 Update Fix (Henry Baker) GCHQ spooks update PC and mobile security advice for public sector (Nap van Zuuren) REVIEW: Craig P. Bauer, Secret History: The Story of Cryptology (Ben Rothke) Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Fri, 18 Oct 2013 10:56:06 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Harry Lewis's blog on Harvard's Gov 1310 Harvard Professor Harry Lewis recently posted a blog item that reviews the episodes leading up to and following Harvard having accused a large number of students of cheating in an open-book open-Web exam in an undergraduate Government course, suspending them en masse, and also surreptitiously searching e-mail accounts, and hiding many of the details from public view. Harry's blog item gives RISKS readers an insider follow-up to the two rather terse external views on this situation that Lauren Weinstein contributed to RISKS-27.19 (11 Mar 2013). 13 Oct 2013: Honor and Dishonor http://harry-lewis.blogspot.com/2013/10/honor-and-dishonor.html For those of you interested in delving further into the history, Harry's blogspot also includes seven previous postings that give a more extensive view of his reactions to how this situation evolved (badly). 3 Feb 2013: Bits and Pieces: Lingering questions about the `cheating scandal' 9 Mar 2013: Bits and Pieces: E-mail Privacy at Harvard 12 Mar 2013: Bits and Pieces: E-mail Snooping Update 6 Apr 2013: Bits and Pieces: Seizing the Opportunity to Restore Trust 27 Apr 2013: Bits and Pieces: E-mail Privacy Update 23 Jul 2013: Bits and Pieces: The Keating Report 2 Sep 2013: Bits and Pieces: E-mail Privacy Redux ------------------------------ Date: Sun, 20 Oct 2013 19:09:21 -0400 From: Gabe Goldberg <gabe(a)gabegold.com> Subject: Dick Cheney Said He Disabled Heart Device to Avoid Terrorist Threats Former U.S. Vice President Dick Cheney said the implanted defibrillator that helped keep him alive in 2007 had its wireless feature disabled because he feared terrorists could use it to kill him. Bloomberg, To read the entire article, go to http://bloom.bg/H50BeO The risk: fear that technology will be abused leads to disabling the technology. Of course, technology subject to abuse -- e.g., medical devices vulnerable to hacking/tampering -- has its own risks. Tough choices. ------------------------------ Date: Fri, 18 Oct 2013 11:52:04 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Judge Posner recants his previous ruling on Voter ID Second Thoughts on Voter ID, Editorial, *The New York Times*, 16 Oct 2013 http://www.nytimes.com/2013/10/17/opinion/second-thoughts-on-voter-id.html?… On 18 Oct 2013, Richard Posner, a highly respected federal judge, offered an unusual admission. He had made a mistake, he said, in voting to uphold one of the country's first voter-ID laws. As courts in Texas, North Carolina and other states deal with litigation over ever-stricter versions of such laws -- all enacted in the name of preventing nonexistent fraud -- the question is what effect Judge Posner's admirable candor could have. In 2005, Indiana passed a law requiring voters to show photo IDs at the polls. Opponents sued, saying the law would mainly prevent those most likely not to have photo IDs -- poor, elderly, and minority voters -- from voting. Judge Posner, a Reagan appointee to the United States Court of Appeals for the Seventh Circuit, rejected the challenge because he saw no evidence that any voters would be disenfranchised, and reducing vote fraud was a legitimate state goal -- despite the fact that Indiana had never prosecuted anyone for that crime. The Supreme Court upheld the ruling in 2008, and proponents of voter-ID laws have relied on that opinion ever since. In an interview with HuffPost Live on Friday, Judge Posner acknowledged that he had failed to appreciate how voter-ID laws would be abused when he wrote the decision upholding the Indiana statute. ``Maybe we should have been more imaginative. We weren't really given strong indications that requiring additional voter identification would actually disenfranchise people entitled to vote.'' Those indications were clear, of course, to judges who disagreed with Judge Posner at the time. In a new book, he writes that he was `guilty' of upholding a law ``now widely regarded as a means of voter suppression rather than of fraud prevention.' Had he spoken those words a few years ago, the landscape of voter-ID laws might look very different. ------------------------------ Date: Fri, 18 Oct 2013 13:20:10 PDT From: "Peter G. Neumann" <neumann(a)csl.sri.com> Subject: Virginia Voter Purge List Democrats say about 1/3 of the names on the purge list were incorrect. An article in *The Washington Post* says that 38,000 of 56,000 names proposed for purge by the State Board of Election were ultimately purged. That's pretty close to 1/3 being incorrect. http://www.washingtonpost.com/local/virginia-politics/federal-judge-rejects… ------------------------------ Date: Friday, October 18, 2013 From: *Suzanne Johnson* Subject: Ship Tracking Hack Makes Tankers Vanish from View [Via Dave Farber's IP distribution] A system used by ships worldwide to broadcast their location for safety purposes lacks security controls and is vulnerable to spectacular spoofing attacks, researchers show. ... ``We were really able to compromise this system from the root level,'' says Kyle Wilhoit, a researcher with Trend Micro's Future Threat Research team. By purchasing a 700-euro piece of AIS equipment and connecting it to a computer in the vicinity of a port, the researchers could intercept signals from nearby craft and send out modified versions to make it appear to other AIS users that a vessel was somewhere it was not. Using the same equipment and software, it is possible to force ships to stop broadcasting their movements using AIS by abusing a feature that lets authorities manage how nearby AIS transmitters operate. AIS transmissions could also be sent out that make fake vessels or structures such as lighthouses or navigational buoys appear, and to stage spoof emergencies such as a `man in the water' alert or collision warning. No direct attacks were staged on any real vessels. The researchers showed that their spoof signals were faithfully reproduced on the maps provided by online services that monitor AIS data, such as this one. <http://www.marinetraffic.com/ais/default.aspx?centerx=3D-118.2055&centery=3…> One online service was fooled into showing a real tugboat disappearing from the Mississippi and reappearing on a Dallas lake, and depicting a fake vessel traveling off Italy on a course that spelled out the hacker term for a compromised system: `pwned'. http://www.technologyreview.com/news/520421/ship-tracking-hack-makes-tanker= s-vanish-from-view/ ------------------------------ Date: Mon, 21 Oct 2013 11:26:46 -0700 From: Gene Wirchenko <genew(a)telus.net> Subject: Crooks 'stole' Experian data the old-fashioned way: They bought it! (Serdar Yegulalp) Serdar Yegulalp | InfoWorld, 21 Oct 2013 Credit bureau sold personal data from half a million users to fraudster posing as a Private Investigator, who then resold data on the black market http://www.infoworld.com/t/cyber-crime/crooks-stole-experian-data-the-old-f… ------------------------------ Date: Sat, 19 Oct 2013 14:58:17 -0700 From: Lauren Weinstein <lauren(a)vortex.com> Subject: "Is Wikipedia for Sale?" "In recent months though, insiders have encountered something altogether more worrying: a concerted attack on the very fabric of Wikipedia by PR companies that have subverted the online encyclopedia's editing hierarchy to alter articles on a massive scale-perhaps tens of thousands of them. Wikipedia is the world's most popular source of cultural, historical, and scientific knowledge-if their fears are correct, its all-important credibility could be on the line." http://j.mp/16nf2Rk (Vice via NNSquad) ------------------------------ Date: Mon, 21 Oct 2013 11:03:12 -0400 From: David Farber <dave(a)farber.net> Subject: NSA Surveillance: The 21st-Century Panopticon (Bruce Schneier) Bruce Schneier, NSA Surveillance: The 21st-Century Panopticon, *The Atlantic*, http://www.theatlantic.com/politics/archive/2013/10/nsa-surveillance-the-21… Director of National Intelligence James Clapper told Congress the NSA doesn't collect information on millions of Americans. (Reuters) The basic government defense of the NSA's bulk-collection programs -- whether it be the list of all the telephone calls you made, your email address book and IM buddy list, or the messages you send your friends -- is that what the agency is doing is perfectly legal, and doesn't really count as surveillance, until a human being looks at the data. It's what Director of National Intelligence James R. Clapper meant when he lied to Congress. When asked, "Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?" he replied, "No sir, not wittingly." To him, the definition of "collect" requires that a human look at it. So when the NSA collects -- using the dictionary definition of the word -- data on hundreds of millions of Americans, it's not really collecting it, because only computers process it. The NSA maintains that we shouldn't worry about human processing, either, because it has rules about accessing all that data. General Keith Alexander, director of the NSA, said that in a recent New York Times interview: "The agency is under rules preventing it from investigating that so-called haystack of data unless it has a 'reasonable, articulable' justification, involving communications with terrorists abroad, he added." There are lots of things wrong with this defense. First, it doesn't match up with U.S. law. Wiretapping is legally defined as acquisition by device, with no requirement that a human look at it. This has been the case since 1968, amended in 1986. Second, it's unconstitutional. The Fourth Amendment prohibits general warrants: warrants that don't describe "the place to be searched, and the persons or things to be seized." The sort of indiscriminate search and seizure the NSA is conducting is exactly the sort of general warrant that the Constitution forbids, in addition to it being a search by any reasonable definition of the term. The NSA has tried to secretly redefine the word "search," but it's forgotten about the seizure part. When it collects data on all of us, it's seizing it. Third, this assertion leads to absurd conclusions. Mandatory cameras in bedrooms could become okay, as long as there were rules governing when the government could look at the recordings. Being required to wear a police-issued listening device 24/7 could become okay, as long as those same rules were in place. If you're uncomfortable with these notions, it's because you realize that data collection matters, regardless of whether someone looks at it. Fourth, creating such an attractive target is reckless. The NSA claims to be one of the biggest victims of foreign hacking attempts, and it's holding all of this information on us? Yes, the NSA is good at security, but it's ridiculous to assume it can survive all attacks by foreign governments, criminals, and hackers -- especially when a single insider was able to walk out of the door with pretty much all their secrets. Finally, and most importantly: Even if you are not bothered by the speciousness of the legal justifications, or you are already desensitized to government invasion of your privacy, there is a danger grounded in everything we have learned about how humans respond when put in positions of unchecked power. Assuming the NSA follows its own rules -- which even it admits it doesn't always -- rules can change quickly. The NSA says it only looks at such data when investigating terrorism, but the definition of that term has broadened considerably. The NSA is constantly pushing the law to allow more and more surveillance. Even Representative Jim Sensenbrenner, the author of the Patriot Act, says that it doesn't allow what the NSA claims it allows. It doesn't make sense to build systems that could facilitate a future police state. A massive trove of surveillance data on everyone is incredibly tempting for all parts of government to use. Once we have everyone's data, it'll be hard to prevent it from being used to solve conventional crimes and for all sorts of things. It's a totalitarian government's wet dream. The NSA's claim that it only looks when it's investigating terrorism is already false. We already know the NSA passes data to the DEA and IRS with instructions to lie about its origins in court -- "parallel construction" is the term being used. What else is done with that data? What else could be? It doesn't make sense to build systems that could facilitate a future police state. This sort of surveillance isn't new. We even have a word for it: It's the Panopticon. The Panopticon was a prison design created by 18th-century philosopher Jeremy Bentham, and has been a metaphor for a surveillance state ever since. The basic idea is that prisoners live under the constant threat of surveillance. It's not that they are watched all the time -- it's that they never know when they're being watched. It's the basis of Orwell's 1984 dystopia: Winston Smith never knew if he was being watched, but always knew it was a possibility. It's why online surveillance works so well in China to deter behavior; no one knows if and when it will detect their actions online. Panopticon-like surveillance -- intermittent, but always possible -- changes human behavior. It makes us more compliant, less individual. It reduces liberty and freedom. Philosopher Michael P. Lynch recently wrote about how it dehumanizes us: ``when we lose the very capacity to have privileged access to our psychological information -- the capacity for self-knowledge, so to speak, we literally lose our selves .... To the extent we risk the loss of privacy we risk, in a very real sense, the loss of our very status as subjective, autonomous persons.'' George Dyson recently wrote that a system that ``is granted (or assumes) the absolute power to protect itself against dangerous ideas will of necessity also be defensive against original and creative thoughts.'' That's what living in a Panopticon gets you. Already, many of us avoid using `dangerous' words and phrases online, even innocuously. Or making nervous jokes about it when we do. By ceding the NSA the ability to conduct ubiquitous surveillance on everybody, we cede to it an enormous amount of control over our own lives. Once the NSA takes a copy of your data, you no longer control it. You can't delete it. You can't change it. You might not even know when the rules under which it uses your data change. And until Edward Snowden leaked documents that show what the NSA is doing, you didn't even know that the government had taken it. What else don't we know that the NSA has or does? ------------------------------ Date: Monday, October 21, 2013 From: *Dewayne Hendricks* Subject: France summons US ambassador to answer allegations of widespread NSA surveillance (Amar Toor) Amar Toor, The Verge, 21 Oct 2013 Agency reportedly recorded millions of French phone calls over 30-day period last year http://www.theverge.com/2013/10/21/4861202/nsa-reportedly-recorded-millions… ------------------------------ Date: October 11, 2013 7:07:01 PM EDT From: Allan Davidson <AllanD(a)SoundBytesRadio.com> Subject: Americans Are Way Behind in Math, Vocabulary, and Technology (Roberto A. Ferdman, *The Atlantic*) "A new global report (pdf) by the Organization for Economic Cooperation and Development finds that Americans rank well below the worldwide average in just about every measure of skill. In math, reading, and technology-driven problem-solving, the United States performed worse than nearly every other country in the group of developed nations." It seems to me that the results should be grounds for serious concern, even though (or perhaps particularly because) China isn't included in the charts. Particularly concerning seems to be the poor performance of the 16-24 compared to the 55-65 year-olds. [Let's hear it for us old people. PGN] ------------------------------ Date: Mon, 21 Oct 2013 10:18:43 -0700 From: Lauren Weinstein <lauren(a)vortex.com> Subject: Google Unveils Technology Tools for Digital Rebels (*Time*) http://j.mp/1a2Irq6 (*Time* via NNSquad) The most ambitious product launch is uProxy, a new Web browser extension that uses peer-to-peer technology to let people around the world provide each other with a trusted Internet connection. This product is designed to protect the Internet connection of users in, say, Iran, from state surveillance or filtering. Google Ideas is providing funding and technical assistance for uProxy, which was developed by researchers at the University of Washington and Brave New Software. ``If you look at existing proxy tools today, as soon as they're effective for dissidents, the government finds out about them and either blocks them or infiltrates them. Every dissident we know in every repressive society has friends outside the country whom they know and trust. What if those trusted friends could unblock the access in those repressive societies by sharing their own access? That was the problem we tried to solve.'' UProxy allows users in the U.S. to give their trusted friends in Iran-people they might already be emailing or chatting with-access to the open U.S. Internet. ``The user in Iran can get unfiltered access to the Internet that's completely uncensored and will look just like it does in the U.S. It's completely encrypted and there's no way for the government to detect what's happening because it just looks like voice traffic or chat traffic. We wanted to build a proxy service that builds on top of trusted relationships that already exist.'' [Knowing what we know about the lack of security and anonymity, how likely is this to be useful in critical environments? PGN] ------------------------------ Date: Sun, 20 Oct 2013 15:02:14 -0400 From: Ed Ravin <eravin(a)panix.com> Subject: More on "online schools" fleecing taxpayers The Forward reported back in 2012 on a similar scam at the college level, where an online school sucks up US Federal grant money meant for low-income students, without actually graduating anyone, and where most of their students weren't even in the US: http://forward.com/articles/163766/how-jewish-college-uses-federal-funds-to… And a recent followup: http://forward.com/articles/184212/chabads-michigan-jewish-institute-may-cl… I doubt this school is the only one playing this game. ------------------------------ Date: Fri, 18 Oct 2013 00:56:53 -0400 From: Anthony DeRobertis <anthony(a)derobert.net> Subject: Re: GPS map leads to border crossing and shooting (Scott Nicol) This is the most misleading Subject: line I can remember having appeared in RISKS. Even "contributes to" seems a stretch, especially since the articles clearly state GPS navigation being involved is *a guess*. "Stealing multiple cars, getting in multiple police chases, and crashing through border patrol vehicles" is more like it... There is an legitimate risk to be discussed here, indeed it appears its easy to miss the "you're crossing an international border" warning; but the results of that should be delay (including maybe having to turn around and take a much longer route), not being shot at! ------------------------------ Date: Sun, 20 Oct 2013 16:38:04 +0200 From: Amos Shapir <amos083(a)gmail.com> Subject: Re: "We can't let the Internet become Balkanized" (Steingold, R-27.55) In RISKS-27.55, Sam Steingold writes: > I actually welcome this scandal because it should bring home to people the > fact that we have lost "the expectation of privacy" battle. What battle? The way the Internet is built and operated, it has been a broadcasting network from day one. No intelligent person should have expected any privacy, any more than when walking on a public street. ------------------------------ Date: Fri, 18 Oct 2013 11:10:14 -0700 From: Gene Wirchenko <genew(a)telus.net> Subject: "Users hit by Blue Screen, 0xC1900101 - 0x40017 error with Windows 8.1 update" (Woody Leonhard) Woody Leonhard | InfoWorld, 18 Oct 2013 Microsoft is struggling to figure out how to handle a widely reported problem when Windows 8 users update to Windows 8.1 http://www.infoworld.com/t/microsoft-windows/users-hit-blue-screen-0xc19001… ------------------------------ Date: Fri, 18 Oct 2013 11:14:08 -0700 From: Gene Wirchenko <genew(a)telus.net> Subject: "Resurrected KB 951847 'zombie' patch fixed -- but now has new problem" (Woody Leonhard) Woody Leonhard | InfoWorld, 18 Oct 2013 Botched patch installs .Net Framework 3.5 without warning or consent -- even on systems that have studiously avoided .Net http://www.infoworld.com/t/microsoft-windows/resurrected-kb-951847-zombie-p… ------------------------------ Date: Mon, 21 Oct 2013 11:31:07 -0700 From: Gene Wirchenko <genew(a)telus.net> Subject: "Problems remain after Microsoft yanks Windows RT 8.1 update" Woody Leonhard | InfoWorld, 21 Oct 2013 Windows RT/8 updates have inspired a stream of complaints. Here's an overview of what's happened, how you might recover http://www.infoworld.com/t/microsoft-windows/problems-remain-after-microsof… ------------------------------ Date: Sun, 20 Oct 2013 05:13:00 -0700 From: Henry Baker <hbaker1(a)pipeline.com> Subject: Microsoft ``Still Working'' on KB2862330 Windows 7 Update Fix FYI -- Obviously, the US Government shutdown kept the NSA from doing final QA on this particular Windows backdoor^H^H^H^H^H^H^H^Hupdate. :-) http://news.softpedia.com/news/Microsoft-Still-Working-on-KB2862330-Windows… October 15th, 2013, 05:31 GMT · By Bogdan Popa - The patch is still being delivered via Windows Update More and more users confirm issues with the KB2862330 Windows 7 update, as the bulletin apparently fails to install on lots of computers, but Microsoft remains pretty much tight-lipped on this subject. Ben Herila, Microsoft product manager, has confirmed through a small post that Redmond is still working to find the cause of the issues, explaining that a free-of-charge support incident is available to anyone willing to help the team deal with the problem. ``We can offer anyone who has this issue and is willing to go through troubleshooting a free-of-charge support incident and Support will work with you 1-1 to get your computer(s) back into a working state. The teams who released this update do know that there may be a problem and are doing additional testing to identify the root cause of the issue that folks are experiencing.'' At this point, the patch is still being delivered via Windows Update, which means that in most cases, the bulletin is expected to install just fine. FILED UNDER: KB2862330 Windows 7 Windows Update Microsoft ------------------------------ Date: Sun, 20 Oct 2013 13:01:28 +0200 From: "Nap van Zuuren" <nap.van.zuuren(a)pandora.be> Subject: GCHQ spooks update PC and mobile security advice for public sector This might be of interest to RISKS readership. Subject: GCHQ spooks update PC and mobile security advice for public sector; CESG offers strengths and weaknesses guide http://news.techworld.com/security/3474201/gchq-spooks-update-pc-and-mobile- security-advice-for-public-sector/?cmpid=TD1N20 https://www.gov.uk/government/collections/end-user-devices-security-guidanc… ------------------------------ Date: Sun, 20 Oct 2013 17:43:28 -0400 From: Ben Rothke <brothke(a)hotmail.com> Subject: REVIEW: Craig P. Bauer, Secret History: The Story of Cryptology Narrating a compelling and interesting story about cryptography is not an easy endeavor Many authors have tried and failed miserably -- attempting to create better anecdotes about the adventures of Alice and Bob. David Kahn did the best job of it when wrote The Codebreakers: The story of secret writing in 1967 and set the gold standard on the information security narrative. Kahn's book was so provocative and groundbreaking that the US Government originally censored many parts of it. A lot has change[d] since 1967, and while Secret History: The Story of Cryptology is not as groundbreaking, it also has no government censorship. With that, the book is fascinating read that provides a combination of cryptographic history and the underlying mathematics behind it. ... Kahn himself wrote that he felt this book is by far the clearest and most comprehensive of the books dealing with the modern era of cryptography including classic ciphers and some of the important historical ones such as Enigma and Purple -- but also newer systems such as AES and public-key cryptography. See more at: http://www.rsaconference.com/blogs/435/rothke/secret-history-the-story-of-c… See the full review here at: http://www.rsaconference.com/blogs/435/rothke/secret-history-the-story-of-c… ------------------------------ Date: Sun, 7 Oct 2012 20:20:16 -0900 From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. The mailman Web interface can be used directly to subscribe and unsubscribe: http://lists.csl.sri.com/mailman/listinfo/risks Alternatively, to subscribe or unsubscribe via e-mail to mailman your FROM: address, send a message to risks-request(a)csl.sri.com containing only the one-word text subscribe or unsubscribe. You may also specify a different receiving address: subscribe address= ... . You may short-circuit that process by sending directly to either risks-subscribe(a)csl.sri.com or risks-unsubscribe(a)csl.sri.com depending on which action is to be taken. Subscription and unsubscription requests require that you reply to a confirmation message sent to the subscribing mail address. Instructions are included in the confirmation message. Each issue of RISKS that you receive contains information on how to post, unsubscribe, etc. => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines. => .UK users may contact <Lindsay.Marshall(a)newcastle.ac.uk>. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you NEVER send mail! => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line. *** NOTE: Including the string "notsp" at the beginning or end of the subject *** line will be very helpful in separating real contributions from spam. *** This attention-string may change, so watch this space now and then. => ARCHIVES: ftp://ftp.sri.com/risks for current volume or ftp://ftp.sri.com/VL/risks for previous VoLume http://www.risks.org takes you to Lindsay Marshall's searchable archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue. Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r <http://the.wiretapped.net/security/info/textfiles/risks-digest/> . ==> PGN's comprehensive historical Illustrative Risks summary of one liners: <http://www.csl.sri.com/illustrative.html> for browsing, <http://www.csl.sri.com/illustrative.pdf> or .ps for printing is no longer maintained up-to-date except for recent election problems. *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 27.56 ************************

1 0

SRF: surveillance costumes
by brian carroll 21 Oct '13

21 Oct '13

// this perhaps relates to the concept of Denial of Disservice in some way... previously i had planned to explore illuminated juggling and eventually move into a signaling context with it, via display of various LED colored balls and clubs in terms of patterns and their structuring, as a way of communicating. then i was under seige and my health, already poor, completely collapsed do i could no longer juggle and the equipment started to malfunction immediately and eventually totally failed.\ part of the idea involved being a targeted individual in the surveillance state, where there is no privacy and no boundaries are observed. therefore, already under active and ubiquitous surveillance, i decided to make the surveillance my audience... juggling for surveillance cameras https://www.dropbox.com/sh/ny4f88s5mrjg7mq/_WqAAxTBQM in a sense this is like probing the network, because it provides a chain-of-feedback that can be accounted for in its effects. again, reversing the panopticon and watching the watchers, via requiring unknown patterns to be mapped, analyzed, deliberated upon, and perhaps cause various subsequent actions to occur in response, whether retaliatory or otherwise. the input of signal causing other signaling to occur, within certain parameters and dimensions, beyond the threshold of my observation though not of others. i thought this was a great idea and others should do similar activities, though was immediately incapacitated and the project was forced into collapse via still ongoing harassment, the front line of a hostile and oppressive political agenda that is unaccounted for in 'official media' and beyond government checks and balances, because the U.S. is a failed dictatorial state. obviously this is not a new idea, and there have been many people involved in such activity... the Surveillance Camera Players http://www.notbored.org/the-scp.html my goal though was signaling with LED juggling clubs, perhaps messaging or seeking connection with those behind the watchful eyes, offering a viewpoint or event for interpretation, providing something to see that is an anomaly or out of the ordinary - perhaps what they are looking for, only in different terms or relations. this is not to mock the real purpose of a security infrastructure in times of extreme threat, necessarily, though it is to question it in the existing parameters and under the existing model of malgovernment, where one group is watching another, as this aligns with political corruption and enemies lists. so what if hundreds of jugglers across the country found various surveillance cameras and began to juggle for those observers of the citizenry, though not to obstruct the view and seek to cause insecurity, and instead to provide a temporary filling of its framework, content, especially in a realm of public space that has become by default *privatized* by this ever-watchful eye and its ideology that evaluates everything in potentially skewed, self-serving exploitative terms -- that everything and everyone could be categorized as a *threat* in the given modeling so what if suddenly surveillance monitors were suddenly to become occupied or filled with content, as if a television station tuning into programming, and in various locations at various times, day and night, jugglers or mimes or actors and actresses in plays could appear, and perform for the cameras, whether short skits or various dramas or vignettes or sketches or routines. this could extend in the mythological as well-- a troupe of black clad stagehands could move an inflatable Loch Ness Monster across the field of view of the surveillance cameras, as if they are invisible on the darkened stage to the audience a short distance away, while the symbolic foreground character reads against the background monotony of same recorded landscape, over and over and over, as night turns to day and day turns into night, again and again. what then if in another location or at another camera, a Sasquatch walks by, or suddenly Yetis appear all over, in all states around the world, along with the odd stray Gorilla suit and perhaps a Wooly Mammoth or Mr. Snuffleupagus. how would such events be interpreted- are these acts of terrorism? what psychological effect may it have on both the observed and observers, or that the observers are themselves being indirectly and directly observed by those they themselves cannot see, and so likewise are in the loop as under suspicion, though by another belief system providing checks and balances and questions this boundaries-crossing activity on the assumption it is inherently good and should be trusted while beyond accounting for its truth, in terms of what data is collected, how is it analyzed, how does this relate to political blacklisting and political attacks against citizens, and so on the problem with activist approaches is that it can become about itself, about the juggler and not what is juggled. it is not about language per se, it is about where it grounds, in what truth and reality, how this is shared and unshared based on how it is interpreted, in what frameworks and dimensions. it is not about an ungrounded in-your-face declaration of perspective that is onesided and skewed to a different partial framework. it is about a common framework for those inside and outside the different boundaries of the surveillance infrastructure - providing a circuit or connection deep within the system that can communicate or provide context or dynamics otherwise absent, enabling review of questioning of existing practices, and demanding oversight, yet not in the form of carrying a sign: citizens demand oversight! (in a worst-case scenario protest can be about ungrounded signage or false displays that further legitimize the practices supposedly opposed, thus functions as an illusion or mirage that is a check-and-balance for allowing things the way they are to be further extended via that 'public oversight' and this can be covertly engineered, allowing a viewpoint to be signed-off on while ungrounded, co-opting secondary relativism into the relativistic fold of pT) in a sense it is to razzle-dazzle the statistical modeling that everything is a threat that appears as an anomaly before the surveillance cameras. this is also to consider a conscientious approach to not obstruct legitimate public safety concerns, do not block a traffic camera for instance, or other such tactics in this context of communication and signaling of extra-dimensional information or content for the surveillers. and so what if "All the world's a stage" is recontextualized in terms of ubiquitous surveillance in this way. 1,000 ballet dancers around the world in front of cameras. 1,000 gorillas. 100,000 Yetis. 100,000 jugglers. what would it mean, what might happen to people who participate, how might it effect the way data is processed and analyzed. what happens to the first wave of people to take the risk of being put on lists and politically attacked...? this is where Jim Bell's approach for Denial of Disservice may provide corollary. if enough people participate, the ability to attack everyone would be more complicated and involve more resources than are available by the given oppositional network. rules would need to be broken, short-cuts taken, which would force quick fixes or other tactics as retaliation. what is known is that likely you will be put on a list of some kind. and perhaps your life will be more pressured or something will happen that is harmful, such as 'mistakes' begin to occur or surrounding bias is suddenly unmasked and you will be discriminated against by this hidden political network. that is actually good, because it reveals what otherwise is unseen. if you can take the hit and keep on moving, that is a win, not a loss. the problem is: when everyone is wearing a mask as their form of engagement, that distance also is a protective boundary. in a civil (standoff) scenario like this, front line volunteers are needed to be a first wave and stand against the oppression. and this requires accepting the fact that you may or will get hurt in some way- this in very soft terms, most probably, unless vulnerable. so if you are demographically strong, your strength protects you against an easy takedown. also, if you have connections, like a strong family support network that provides protection, including monetary support, so that you can push back against any power-based incrimination or defaming of character via gossip or whisper campaigns, these probably inescapable though. (if you are going to wage war you need people willing to fight, people who can overcome their fear of getting hurt for the larger gains that can be made by taking on the opponent -- actions should not be limited to zones where no harm occurs, because then it is easy to rationalize doing nothing is the safest route, and that is where the power of the status quo has its edge, by defining and protecting and defending that boundary based on fear and timidity) it is not a situation where no one will get hurt, and participants will be guaranteed to get medals and A's on their report cards. something probably will happen to those who first participate, the beast will start breathing around their vicinity and things will change. and yet, if a group or individuals can go into it and survive and weather the situation, within a perfectly legal framework, no subversion or ill intent, then the law should be a protection against any such threats or illegal manipulations, given you are not entirely alone and can be setup or framed and taken down in isolation* *(what if an elderly person who lives in a nursing home participates, goes into the park and joins a sing along or a dance in front of the cameras -- will their medical mistake soon occur and they die of a wrong dosage or quickly pass due to unaccountable error? this is the reality of the political situation and how it cascades into other areas, no hyperbole. it is real, it is happening, via secret channels and connections that carry out such hidden actions) what if, for instance, someone went up with a flash light and sent a morse code signal during the night into the network as communication, or in the day time used placards as if a dylan rolling stone video, and used the surveillence stage for conveying poetry or a perspective of cultural importance. or, that as parade is planned and a community marches before the surveillance cameras as if showing off their military gear to a hidden and remote emperor. then it was realized there is more to this situation than just performance art or other activity on the stage of surveillance, instead, as pattern matching is concerned -- it has a holiday dimension to it... perhaps the most telling thing about the meekness of the present day is that there are no costumes with people as surveillance cameras -- the biggest joke of them all. that is, dressed entirely in black, and having a black hat or cap with a mock-surveillance camera or webcam attached. the more plastic and standardized the better, though perhaps homemade would need to occur first. it could signify many things simultaneously... that there is a competing human surveillance network that is surveilling the surveillers, or observing the observers who will be held accountable for their crimes. likewise, people wearing Google Glass are basically the same thing, yet a privatized surveillance network of citizens who will be monitoring other citizens every day of the year, wherever they are. it is not a costume- it is the real thing. the difference is that the all black simple yet ubiquitous holiday costume is for human interests, and of a public dimension, while this is not the case for the private version which feeds everything back into a private hidden framework where it can be and is being exploited, beyond citizen interests and accountability for how this information is collected, collated, and used against citizens as part of this larger societal oppression that is surveillance as an political ideology, as a basis for social control and engineering a ruling class based on exploiting secrets and blackmailing and blacklisting opponents Google Glass is the citizen watchdog program taken to the extreme, becoming distributed citizen monitoring of one group of citizens by another via a remotely connected, distributed surveillance infrastructure that becomes 'identity' itself- the perspective or viewpoint is firstly technological, as the social relation, and within that framework and dimensions -- it is Google-as-citizen, yet they have more rights than every other non-corporate citizen, it is thus their society and their country, we are merely living in it, temporarily, until phased out Catch Pranksters on Halloween Night with a DIY Surveillance Pumpkin http://halloween-ideas.wonderhowto.com/how-to/catch-pranksters-halloween-ni… so, why stop at Halloween when things are hilarious... why not have a national and international Surveillance Day on the calendar, perhaps removing thanksgiving in the U.S. for this and replacing it with thanks to the state... even further, why not finally remove the pretense of Presidents day and finally rename it "Eternal President Day" to ground the holiday calendar in the realism it deserves as a basis for shared awareness- or if really going for it: Crypto-Dictatorship Day Hell, maybe there could even be a Backdoors Day, or make it week, or month, or year-long or multi-year festival, as this relates to security, secrecy, privacy, and the failed and corrupt state in its sideological and standardized maldevelopment. there are likely other suggestions for potential holidays and it would be worthwhile to consider how Valentines could turn into Free Porn Day or Mother's Day into "Hate Her" day, to finally reflect the fact that women are treated equivalent to toilet paper in this failed society and destroyed civilization. what more is there to say. oh yeah-- "The Binary Crypto Regime is the bullshit" holiday! -- that is every day of the year... ☘

2 2

re: jugging & code
by brian carroll 21 Oct '13

21 Oct '13

grarpamp wrote: > https://en.wikipedia.org/wiki/Siteswap > > An obfuscated means of message encoding, or just a > trancelike game... there are a lot of possibilities, siteswap notation is one of these though i never figured it out in terms of practical use, though for those exploring and searching out new patterns it apparently provides a mathematical framework for what could be possible juggling is a very interesting realm to investigate for many reasons, one of which is its looping patterns which can be changed during the pattern itself, perhaps this a form of processing, grammar, or syntax of some kind. likewise, color can be used to outline or to provide additional correlations, say if a ball is being sent back & forth over the top (think this is 'rainbow' pattern), if it is different color than the other two balls it can help see the dynamics in a way that same-colored juggling equipment cannot. my view is that much could be communicated this way via LED balls and clubs though my skills are extremely limited in this realm whereas others excel at juggling and could explore ideas fully i think PS4 and X-Box360 with tracking cameras would be ideal platforms with RFID juggling balls to teach people how to juggle via step-by-step instruction. the book Art of Juggling is a guide for this, though also involves a philosophy of learning via juggling which i think is most accurate about its underlying, hidden value as a way of 'learning from mistakes' and incrementally achieving what can be very difficult goals through trial & error and practice it also reprograms the nervous system via ambidextrous action of both side of the brain and nervous system and thus rewires circuitry which can help dealing with stroke or other issues, including coordination, memory loss; challenges, optimizes my research interest is in the relation of juggling and music as a way of approaching music from a different perspective, under the assumption anyone can play a musical instrument, if using a similar pattern based approach for exploring music, start simple and then modify and further develop patterns, which is how juggling works, first one ball, then two, then three, then four... (that is my limit now, three clubs also) Codes and Clowns: Claude Shannon the juggling scientist http://www.youtube.com/watch?v=1zEsao7Da4s also, juggling patterns could be a basis for establishing a model for heuristic evaluation of looping hypotheses where constellations of patterns move through a context and may alter or change its functioning, transform the looping model and thus what the parameters, boundaries, rules could be if considering this in terms of N-patterns being juggled (then likewise, what if a four or five ball pattern looks like a three ball pattern from within a certain boundary, etc)

1 0

Re: [Cryptography] Mail Lists In the Post-Snowden Era
by grarpamp 21 Oct '13

21 Oct '13

On Mon, Oct 21, 2013 at 2:20 PM, Michael Kjörling <michael(a)kjorling.se> wrote: > On 21 Oct 2013 04:39 -0600, from gdr(a)gno.org (Devin Reade): >> I would be surprised if there is not software in existence that >> could correlate poster's mannerisms against publicly available >> non-anonymized postings to in effect de-anonymize the supposedly > > There has at least been publicly done research on the matter. See for > > https://www.schneier.com/blog/archives/2011/03/using_language.html > > which references a web page which unfortunately since then appears to http://dmas.lab.mcgill.ca/fung/ http://users.encs.concordia.ca/~debbabi/ The topic has been around far longer than the above.

1 0

Re: [Cryptography] Mail Lists In the Post-Snowden Era
by grarpamp 21 Oct '13

21 Oct '13

On Mon, Oct 21, 2013 at 6:39 AM, Devin Reade <gdr(a)gno.org> wrote: > At the risk of stating the obvious, going to an anonymized list > is not without its own problems. One big part of the usability of > many mailing lists involves the reputation of the poster. Take > this list for example: I am not a cryptographer (I'm a software > architect and developer). I've found the conversations on this > list interesting and it gives me things to think about in the > design and implementations of my own systems (and those of my > clients). > > So what's the difference between this list and some arbitrary > list full of crackpots? Here, if there is an argument that I > can't quite follow in sufficient detail to satisfy myself, one > option is to examine other sources with respect to the posters > and the topics at hand, and how they are considered by other > publicly-known cryptographers. It's not the the best, but it > helps. Some people have a desperate need for the State to validate other people's names and faces and lives before they feel comfy. Other people are just fine with knowing them (and by whatever moniker) in the context in which they know them. A list full of crackpots running on the hidden undernets is just as easily validated as one in the real world... it's a question of content and how well developed in whichever world (or both) the context is. > As an aside, on a public list or bulletin board (anonymous or not) > I would be surprised if there is not software in existence that > could correlate poster's mannerisms against publicly available > non-anonymized postings to in effect de-anonymize the supposedly > anonymous postings with a reasonable degree of accuracy. Don't post in both worlds. Or do. Or post your face or name or whatever else, or not. It's your choice. In a hidden medium others can make their own choices. Confusing?, not feeling comfy? ... then stay Stateside.

1 0

Re: [Cryptography] [RNG] on RNGs, VM state, rollback, etc.
by Kent Borg 21 Oct '13

21 Oct '13

On 10/21/2013 09:48 AM, Christoph Anton Mitterer wrote: > On Sun, 2013-10-20 at 16:32 -0400, Russ Nelson wrote: >> We *all* know that all cryptography can be cracked; it's just a matter >> of resources and time. > *cough* OTP... Also, the universe is of limited size and life expectancy: the "resources and time" bit really matters once the numbers get big. In isolation of a larger analysis (of the threat and the definition of the system boundaries being defended) there are still useful things to say. Such as ROT-13 is extremely weak, DES medium weak, AES-256 likely very much stronger, OTP completely strong. But the system boundaries matter. I don't hold AES-256 responsible for protecting the secrecy of the key, though that matters in a larger system (try memorizing and accurately entering 256-bits, it ain't easy). Similarly, I don't hold OTP responsible for key generation nor key distribution, though those do become extremely important when designing the larger system. One has to look at the larger system if one wants to draw conclusions about the security of the larger system (and so on for the system larger than that, and the one larger than that). But components can still be examined, at each level, weaknesses found, improvements made. In the case of and RNG (as with much of crypto), failures can be silent. It makes sense to build into an RNG the ability to refuse to work absent any seed (or entropy, as the case may be). It makes sense to make this facility have parameters that can be tuned by those using it when carefully building a larger system. It further makes sense to choose defaults that give those larger designers as much help as possible, hurt as little as possible, and try to reduce the "fail silently" property to fewer cases and lesser severity. If the RNG also mixes in locally unique information that isn't particularly secret (MAC addresses, time, etc.), as long as it doesn't hurt, I conclude it doesn't hurt and it is worth doing. Even if you don't know what the larger system is, it helps. A little like a crypto angorithm having more rounds, it usually helps. The refusal to look at the component without first being served your cookies and milk is pedandic silliness. Like refusing to reduce the failure rate of your bolts, nor examine their strength, because it is the fault of the bridge builder for not doing the entire analysis and using enough bolts. Yes, the bridge builder should do his/er job. But it is still worth talking about bridges independent of any specific structure. It is still worth studying bolts independent of specific bridges. Similarly, reducing the silent failure modes of RNGs, and making residual failures less fatal, is worthwhile. -kb _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

How to Get Ahead at the NSA
by harmony 21 Oct '13

21 Oct '13

Nothing new here, but Daniel Soar at the LRB has done some considerable homework: http://www.lrb.co.uk/v35/n20/daniel-soar/how-to-get-ahead-at-the-nsa

1 0