- cypherpunks - lists.cpunks.org

Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps
by Razer 11 Oct '17

11 Oct '17

A little old, but many of these "VPNs" are still probably insecure... For the record, from August 2016: > Millions of users worldwide resort to mobile VPN clients to either > circumvent censorship or to access geo-blocked con-tent, and more > generally for privacy and security purposes. In practice, however, > users have little if any guarantees about the corresponding security > and privacy settings, and perhaps no practical knowledge about the > entities accessing their mobile traffic. In this paper we provide > a first comprehensive analysis of 283 Android apps that use the > Android VPN permission, which we extracted from a corpus of more than > 1.4 million apps on the Google Play store. > > We perform a number of passive and active measurements designed to > investigate a wide range of security and privacy features and to study > the behavior of each VPN-based app. Our analysis includes > investigation of possible malware presence, third-party library > embedding, and traffic manipulation, as well as gauging user > perception of the security and privacy of such apps. Our experiments > reveal several instances of VPN apps that expose users to serious > privacy and security vulnerabilities, such as use of insecure VPN > tunneling protocols, as well as IPv6 and DNS traffic leakage. We > also report on a number of apps actively performing TLS > interception. Of particular concern are instances of apps that > inject JavaScript programs for tracking, advertising, and for > redirecting e-commerce traffic to external partners. 16 page pdf: https://research.csiro.au/ng/wp-content/uploads/sites/106/2016/08/paper-1.p… https://dl.acm.org/citation.cfm?doid=2987443.2987471

1 0

The Saker - A crash course on the true causes of “antisemitism”
by Zenaan Harkness 11 Oct '17

11 Oct '17

Yes I know, ordinarily such a subject line would simply not pass muster, and perhaps many spam filters will bin it by default - worry not dear reader, evidently your spam filtering abilities are a cut above the average :) The Saker brings the usual insight and concise, fact based analysis to the table. Enjoy :) A crash course on the true causes of “antisemitism” - http://thesaker.is/a-crash-course-on-the-true-causes-of-antisemitism/ - http://www.unz.com/tsaker/a-crash-course-on-the-true-causes-of-anti-semitis…

1 2

Punked: Jamie Dimon re Cryptocurrency is Scam
by grarpamp 10 Oct '17

10 Oct '17

https://www.reddit.com/r/CryptoCurrency/comments/75gskt/fullpage_crypto_ad_… https://www.reddit.com/r/Bitcoin/comments/75gyat/crypto_and_jamie_dimon_in_… Now that's advertising ;) btw, $5k within 48 hours.

1 0

OpenBSD 6.2 Released
by grarpamp 10 Oct '17

10 Oct '17

https://www.openbsd.org/62.html https://wikipedia.org/wiki/OpenBSD

1 0

"the Jim Bell effect" on Bitcoin price
by jim bell 10 Oct '17

10 Oct '17

Sent from Yahoo Mail on Android

5 8

Timelock encryption
by George Violaris 10 Oct '17

10 Oct '17

Some interesting reading regarding timelock encryption. Given crypto breakthroughs through cryptocurrency and smart contracts, it is interesting to be able to apply such techniques in fields such as insurance, bonds, trading, etc. The big issue up to now with these is that a trusted third party, e.g, a server, was required to keep track. However now with bitcoin and blockchain technologies, this kind of research is starting to change. - Gwern.net - Self-Decrypting Files: https://www.gwern.net/Self-decrypting-files Rabin & Thorpe - Time-Lapse Cryptogrpahy: http://www.eecs.harvard.edu/~cat/tlc.pdf / http://www.eecs.harvard.edu/~cat/papers/tlc-poster.pdf Tibor Jager - How to Build Time-Lock Encryption: https://eprint.iacr.org/2015/478 Jia Liu and Saqib A. Kakvi and Bogdan Warinschi - Extractable Witness Encryption and Timed-Release Encryption from Bitcoin ./gv

1 1

RFD: Harrison and Appelbaum - Whistleblowers and Wikileaks
by grarpamp 10 Oct '17

10 Oct '17

https://roomfordiscussion.com/interview/sarah-harrison-jacob-appelbaum-wiki… Whistleblowers & Wikileaks “Days later, Harrison said goodbye to Snowden and flew to Berlin. She had been with him in Moscow for four months. On what was said to be legal advice, she declined to return to the UK. The German capital and East Berlin in particular was now a hub for a growing number of Snowden exiles: Poitras, journalist Jacob Appelbaum and Harrison. For anyone with a sense of history this was ironic. Stasiland had become and island of media freedom” (The Snowden Files, L. Harding, p.333). This was 4 years ago, but how is the situation today for the people who helped Edward Snowden? How has WikiLeaks changed since then? Is Edward Snowden still in a critical situation? What about Chelsea Manning and all the other whistleblowers? Where do we draw the line between truth telling and treason? This and much more will be discussed on the 12th of October at Room for Discussion with two of the main figures that were in the eye of the cyclone during the Snowden case in 2013! We will have the honour to interview Sarah Harrison (one of the closest advisers of Julian Assange) and Jacob Appelbaum (former ‘evangelist’ of the Tor Project and hacktivist) on the current state of whistleblowers and of Wikileaks. We hope to see you there! Practical Information Guests: Sarah Harrison & Jacob Appelbaum Interviewers: Paolo Destilo & Valentina Gianera Time: 13:00 – 14:00 Date: 12th of October

1 0

Carbon fiber bombs
by jim bell 09 Oct '17

09 Oct '17

Check out this post in the South Korea vibe: South Korea developing graphite 'blackout bombs' to paralyse North's electrical grid https://www.yahoo.com/newsroom/vibes/south-korea/v-50a3291a-1aa0-3389-b071-… Sent from Yahoo Mail on Android

4 3

Re: IBM OpenPOWER9 CPU [re: Closed Intel / AMD Firmware]
by Steven Schear 09 Oct '17

09 Oct '17

Agreed that the POWER series are at (or perhaps above) most people's price point. Its a shame non-SOC ARM PCs aren't common to avoid the easily hidden backdoors afforded by integrated processors. Warrant Canary creator On Oct 8, 2017 7:22 PM, "grarpamp" <grarpamp(a)gmail.com> wrote: > On Sun, Oct 8, 2017 at 3:11 PM, Steven Schear <schear.steve(a)gmail.com> > wrote: > > Why not switch to much more open CPUs (e.g. POWER8/9) which are already > > comparable to much of Intel's higher end server chips. > > Power8 is an intermediate generation now on phaseout, where > Power9 seems more part of a fuller openpower initiative that might > stand up to Intel / AMD. The entire early 9 production output was > being vacuumed up by military / big data / compute, and retail is > taking a while to evolve. It's good stuff however power is still an > expensive platform for non enterprise end users to just buy > casually, and to pay electric on, but the openness might win. > Power9 scaleout SO is rather less than scaleup SU versions. > > If you want me to switch and get in the game early, perhaps > with review coinmining and shell ftw, you know what to do... ;) > BTC:1CQYSaF8Cqx5ZSgaKG9LE8UrEJAkWqFpLa > > https://wikipedia.org/wiki/OpenPOWER_Foundation > https://wikipedia.org/wiki/POWER9 > https://news.ycombinator.com/item?id=12351319 > https://www.nextplatform.com/2016/04/06/inside-future-google > -rackspace-power9-system/ > https://blog.rackspace.com/the-latest-zaius-barreleye-g2-ope > n-compute-openpower-server > https://www.nextplatform.com/2017/09/19/power9-rollout-begin > s-summit-sierra/ > https://www.enterprisetech.com/2014/07/15/open-sourced-bios- > helps-power8-compete-x86/ > http://www.theplatform.net/2015/03/23/inside-the-rackspace- > openpower-megaserver/ > https://www.servethehome.com/?s=openpower > https://www.anandtech.com/SearchResults?q=openpower > http://www.storagereview.com/search/node/openpower > https://hn.algolia.com/?query=power9&sort=byDate&prefix&page > =0&dateRange=all&type=story > > https://raptorcs.com/TALOSII/ > https://raptorcs.com/content/base/faq.html > https://news.ycombinator.com/item?id=14956257 > http://tyan.com/campaign/OpenPOWER/ > > https://github.com/open-power > https://github.com/openbmc > > https://wiki.freebsd.org/POWER8 > https://www.freebsdnews.com/2015/03/04/freebsd-power8-its-alive-2/ > https://svnweb.freebsd.org/base?view=revision&revision=279189 > https://www.freebsd.org/news/status/report-2015-01-2015-03.h > tml#FreeBSD-on-POWER8 > https://reviews.freebsd.org/search/query/oIdoWWKTe71p/ > > https://www.phoronix.com/scan.php?page=news_item&px=Linux-4.8-More-POWER9 > https://www.phoronix.com/scan.php?page=news_item&px=Power-Ch > anges-Linux-4.12 > https://www.phoronix.com/scan.php?page=news_item&px=Raptor-Talos-2-Teaser > https://www.phoronix.com/scan.php?page=news_item&px=Talos-2- > POWER9-Pre-Order > https://www.phoronix.com/scan.php?page=news_item&px=Talos-2- > FSF-RYF-Possible > > http://www.fsf.org/resources/hw/endorsement/respects-your-freedom > https://www.fsf.org/blogs/licensing/only-a-short-time-left- > to-pre-order-the-talos-ii-pre-orders-end-september-15th > > Minimum to boot and scale cost users roughly $3300 incl 2x cpu, ps, 32gb. >

1 0

dark web briefest intro - was Re: educate me Please
by Zenaan Harkness 09 Oct '17

09 Oct '17

----- Forwarded message from Zenaan Harkness <zen(a)freedbms.net> ----- > Hi Zee, What is the reality of this dark web? If it doesn't show > on Google, then how can you find it? ... As to the dark web - it certainly exists. As we see on the news, every 2 or 4 years the authorities take down one or other of the largest dark web "market place" websites - so evidently these places attract a lot of people. And then there are the smaller sites they take down which usually don't hit the front page of the news. There are all sorts of dark web sites - market places, forums, simple websites, ssh gateways (apparently a lot of people access their normal web servers over ssh), and apparently a lot of ways to slip up for those doing something illegal - and Tor is designed so that the large state-level authorities can pretty much always uncover someone if that's what they want to do; Tor is not secure against GPAs (Global Passive Adversaries), and is absolutely not secure against an active adversary. One of the key features that the Tor company/group has never implemented is chaff-filled network - that is, you specify "I want to allocate 100 KB/s to my node, and I want that divided equally amongst my outward connections, and any peer node that "randomly drops" packets, becomes less trusted by me. I asked the devs directly (or someone else did, can't remember for sure), and the reason came back "our funding proposals for this feature have never been approved" - which makes sense, since the CIA, DIA, DOD and NSA fund the creation of the Tor network, they don't want to fund features which make it much harder for them to uncloak users they are targetting. A volunteer could also try to implement this feature, but it's a lot of work, and even the I2P folks have not yet even tried to implement it. So, even if you were researching data/info for a book you are writing, you really need to spend a lot of time reading about the security aspects, to find out what can give you even a small modicum of "reasonable plausible deniability" for your research activities. For example: - run an exit node (carries its own risks, but one of the better ways to achieve plausible deniabililty) at home - alternatively, or in addition, configure your node as a bridge/ Tor-network entry node, and invite a handful of friends to use it as their gateway to the Tor network (the alternative, if you don't run your own node, is that Tor browser picks a random node to use to enter the Tor network, and there's a damn good chance the CIA or FBI are running that node) - don't run Tor browser on Windows - don't run Windows of any version - learn Qubes OS or Tails OS and use that - experiement for a few months with something completely innocuous - running a website promoting information about Marijuana or something, and once you're comfortable, then move on to something more innocuous - if you choose to run a Tor node (can increase the security, can reduce it if you stuff up the config) there are plenty of folks on the Tor mailing lists who will answer questions, and plenty of links to read to Stay Safe (C)(R) - if you intend to run a dark web website that some authorities really would not like - say e.g. promoting homosexuality to the Saudi's - then you should really be running your own ISP with multiple internet links (e.g. Telstra and Optus), so that any virtual servers you link into the dark web are relatively robust; then, never allow your website to get too popular - keep it to a very manageable number of invitees - never make your invites over the clear net (normal internet) only invite truly trusted friends in person, face to face, with mobile phones turned off and out of reach of all recording devices (including of course, all phones); to invite random people, do so on a dark web forum only. - if you're going to run a dark web website, you really, really, really need to know how to configure firewalling, web server, https certificates, ssh for admin access etc etc, in such a way as to be truly, actually, secure, if there's any chance your website is going to be targetted by the local authorities from your own jurisdiction, you need to not make even 1 single mistake - that mistake will bring you undone! Good luck :) Zen ----- End forwarded message -----

7 15