- cypherpunks - lists.cpunks.org

Avaaz in "grave danger" due to GMail spam filters
by rysiek 26 Aug '13

26 Aug '13

OHAI, I happen to be on Avaaz's info distribution list, and I got an e-mail lately that Avaaz is in "grave danger" as GMail will now filter mailings like that out to a separate folder for similar spam-ish (yet not spam per se) mailings. So what they're asking people to do is to reply directly to that e-mail, so that GMail will note that Avaaz's mailings are not to be messed around with. Instead of telling people, you know, to decentralise and use other, smaller providers. I facepalmed so hard I could cry. It's Stockholm Syndrome if I ever saw one. "GMail fucks us in the arse, so let's ask them politely to use some lubricant". My question is: does *anybody* on this list have some kind of contact within Avaaz? I'd *love* to talk to them about it. It's simply disingenuous to do such a campaign and *not* at least signal "oh and by the way, had we all been still using different, dispersed, decentralised e-mail services we wouldn't get even close to having this problem". -- Pozdr rysiek

14 36

Equilibrium 51% Attack Cost of Bitcoin Network
by Rich Jones 26 Aug '13

26 Aug '13

Nifty little tool showing the estimated cost of controlling the majority of the Bitcoin network: https://www.resallex.com/bitcoin/brix Would love to see something similar for the Tor network - my guess is that the cost there is probably at least an order-of-magnitude lower, but that's just my intuition. R >From the site.. > Introduction > > *Equilibrium 51% Attack Cost:* This is a metric attempting to calculate > the total present value cost required to attack the Bitcoin network through > majority hashing power (51% attack). The metric is meant to be viewed as a > snapshot in time as if an attacker decided to invest in attacking the > network under the current conditions. > *BRIX Score:* "Bitcoin Robustness Index" - The relative rank of Bitcoin's > 51% attack cost compared to annual military expenditures among all nations. > Method This metric is, in essence, equal to 51% of the present value > ("PV") of all future revenues derived from bitcoin mining using current Mt. > Gox prices. Revenues include both block rewards and transaction fees. The > purpose behind using PV as a measuring tool is to approximate the > incentives to miners to build upon the Bitcoin network. The measure can be > viewed as an aggregate of all the cost-benefit analyses done by individual > miners. We believe this is superior to other methods of calculating the > attack cost, including variables such as current hash rates and current > capital costs, because the model is independent of technology advancements. > Under the equilibrium model, miners will continue to invest in equipment > until they reach the point where marginal cost equals marginal revenue (the > point of profit maximization). Under perfect competition (of which bitcoin > mining is effectively), this point will also be where aggregate cost equals > aggregate revenue. If we assume the variables that can affect mining > revenue are held constant ($/btc & transaction fees), then it is easy to > calculate aggregate revenue and therefore also aggregate cost. Since we > know aggregate revenue equals aggregate cost, by calculating 51% of > aggregate revenue we effectively calculate 51% of the aggregate cost to > miners. > > > We calculated this metric by discounting each block reward (210,000 > blocks) as if it were an annuity and then discounting it further to its > present value. Then, we added estimated transaction fees based off > historical records. > Assumptions > > This metric is meant to represent a model at equilibrium. Therefore it > represents a snapshot of 51% of the incentive to miners at the current > price and current transaction fee levels. The idea is that miners are > willing to invest in the network as long as it is profitable to continue > doing so. We assume the following: > > - * Rational Actors: * We assume all mining participants are rational > actors and strictly pursue profit maximization. We ignore all other > motivations, including political, emotional, and reputational. All other > heuristics and biases are ignored. > - * Static Variables: * We assume that the variables in the model are > static, and therefore represent a 'snapshot in time'. There are no growth > forecasts for either price or transaction fees. > - * Perfect Competition: * We assume that all miners and potential > attackers have access to the same technology, resources, and information. > There is no technological advantage for any party that would exclusively > decrease mining costs or otherwise acquire mining equipment faster. > - * Discount Rate: 8% * Our model discounts future cash flows by 8%. > >

2 1

Re: [FoRK] [liberationtech] Fwd: [riseup] Space for dissent
by dan＠geer.org 25 Aug '13

25 Aug '13

[ cross-posting will fail unless someone else wants to do it ] The leading snippet of the forwarded piece, > What surveillance really is, at its root, is a highly effective > form of social control. The knowledge of always being watched > changes our behavior and stifles dissent. The inability to associate > secretly means there is no longer any possibility for free > association.... is called "anticipatory compliance," a term due to Shoshana Zuboff who said "[W]e anticipate surveillance and we conform, and we do that with awareness. ... Once anticipatory conformity becomes second nature, it becomes progressively easier for people to adapt to new impositions on their privacy, their freedoms. The habit has been set," and that quotation is from a couple of decades ago. More recent and more relevant to this topic is this: http://www.faz.net/aktuell/feuilleton/the-surveillance-paradigm-be-the-fric… which is too long to quote and too good to abridge. Speaking for myself, I touched on this in my column for IEEE S&P of last January, Identity as Privacy http://geer.tinho.net/ieee/ieee.sp.geer.1301b.pdf In the meantime, and with allowances for approximation, as of 2013, it is possible to: recognize your face at 500 meters recognize your iris at 50 meters recognize your heartbeat at 5 meters recognize your gait by your smartphone via its accelerometer read your keystrokes on your smartphone via its accelerometer identify your car from its Bluetooth tire pressure sensors geo-locate you indoors via Wifi interaction with other devices know what you are doing via your Smartgrid elec meter identify you even if you never post photos; someone else has read 1" block letters from orbit etc. Disconnecting as a purposive decision is no longer a mere reaction to the demise of some "expectation of privacy" but rather the realization that the Internet is more and more a tool of control, not emancipation. As the source of risk is dependence, risk reduction goes straight to dependence reduction. --dan _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork

1 0

Re: [cryptography] urandom vs random
by Eugen Leitl 25 Aug '13

25 Aug '13

----- Forwarded message from Peter Gutmann <pgut001(a)cs.auckland.ac.nz> ----- Date: Thu, 22 Aug 2013 23:05:50 +1200 From: Peter Gutmann <pgut001(a)cs.auckland.ac.nz> To: cryptography(a)randombit.net Subject: Re: [cryptography] urandom vs random Just appeared on the GnuPG list: NeuG 0.11 was released. NeuG is an implementation of True Random Number Generator based on quantization error of ADC of STM32F103. It is basically intended to be used as a part of Gnuk, but we also have standalone USB CDC-ACM version (you can get random stream from /dev/ttyACM0). Standalone version is useful to feed entropy to /dev/random on GNU/Linux. Its generation speed is >= 50kB/sec, and it's more when connected to USB 2.0 Hub. The output is tested NIST STS 2.1.1 and Dieharder 3.31.1. Highlights are: * Replacement of kernel (thread library) Instead of ChibiOS/RT, we now use Chopstx. * Improved performance The output of random numbers got faster than the previous implementation by 30% or so. * Unsupported targets CQ_STARM, STBEE, STBEE Mini, and STM32_PRIMER2 are not supported in this release, but porting should be easy. Here are some links for NeuG, Gnuk and FST-01 (the hardware). NeuG (under Gnuk Repository): http://gitorious.org/gnuk/neug Gnuk News: http://www.fsij.org/gnuk/ FST-01 introduction: http://www.seeedstudio.com/wiki/index.php?title=FST-01 FST-01 Q&A site: http://no-passwd.net/askbot/questions/ Japanese Documentation for FST-01 and Gnuk Token: http://no-passwd.net/fst-01-gnuk-handbook/index.html Enjoy, _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] Appearing American and VPNs writ large
by Eugen Leitl 25 Aug '13

25 Aug '13

----- Forwarded message from Griffin Boyce <griffinboyce(a)gmail.com> ----- Date: Fri, 23 Aug 2013 13:51:09 -0400 From: Griffin Boyce <griffinboyce(a)gmail.com> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] Appearing American and VPNs writ large User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130803 Thunderbird/17.0.8 Reply-To: tor-talk(a)lists.torproject.org On 08/23/2013 12:41 PM, Nathan Suchy wrote: > I'd beg to differ. There are very good VPN providers that keep absolutely > no logs so you would have anonymity in that case. I think a commercial vpn > without logs is the best way to go but you could also handpick nodes (tor > needs to have a auto feature which can auto pick nodes by country. Covert > Browser for IOS allows you to pick your exit node. You're assuming that there's endpoint anonymity and that no one could correlate you connecting to Server A and a piece of traffic coming from Server A at the same time. At a basic level, this type of correlation is responsible for Jeremy Hammond's arrest (his VPN disconnected from IRC right as he lost internet -- deniability is useless here). And any iOS device is likely keeping track of your recent server connections. If I had a week, I couldn't list all the cases where someone mislaid their trust in a service provider to protect them. Deniability is dead. What Tor provides is unlinkability. best, Griffin -- "Cypherpunks write code not flame wars." --Jurre van Bergen #Foucault / PGP: 0xAE792C97 / OTR: saint(a)jabber.ccc.de My posts, while frequently amusing, are not representative of the thoughts of my employer. -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tahoe-dev] weekly dev chat notes from 2013-08-21
by Eugen Leitl 25 Aug '13

25 Aug '13

----- Forwarded message from Zooko Wilcox-OHearn <zooko(a)leastauthority.com> ----- Date: Fri, 23 Aug 2013 17:49:57 +0000 From: Zooko Wilcox-OHearn <zooko(a)leastauthority.com> To: Tahoe-LAFS development <tahoe-dev(a)tahoe-lafs.org> Subject: [tahoe-dev] weekly dev chat notes from 2013-08-21 notes Tahoe-LAFS Weekly Dev Chat 2013-08-21 in attendance: Zooko (scribe), Jeff "psi2", Mark, zab, Brian Agenda Item 1: next week's Dev Chat for the next Weekly Dev Chat meeting, we're going to do an experiment: * invite people more widely (everyone who reads tahoe-dev, everyone who follows me (zooko) on twitter, etc.) * upload a recording of the dev chat to youtube * try to finish reviewing #1382 *before* the meeting so that we can focus the meeting on: * planning Tahoe-LAFS v1.11! Agenda Item 2: I2P patches Jeff and zab from the I2P project joined Tahoe-LAFS Weekly Dev Chat for the first time to help us integrate the patches that I2P needs in order to use an unmodified LAFS on I2P. Jeff tagged the specific tickets that are blocking the I2P people on that: https://tahoe-lafs.org/trac/tahoe-lafs/query?status=assigned&status=closed&… We dug into #1010. We agreed to make a "[node]anonymize", which means "On startup, verify that all configuration options are compatible with anonymity. If any aren't, stop the process with a useful error message about the configuration option that is dangerous to anonymity.". Action item for me: add a comment to that proposing a configuration UI that I would like, then email Brian about it. Action item for Jeff: update the patch on #1010. https://tahoe-lafs.org/trac/tahoe-lafs/ticket/1010# use only 127.0.0.1 as local address Agenda Item 3: Tahoe-LAFS v1.11.0 I don't want to release Tahoe-LAFS v1.11 with regressions that make it worse than Tahoe-LAFS v1.10. Currently, there are seven such regressions! https://tahoe-lafs.org/trac/tahoe-lafs/query?status=assigned&status=new&sta… The next step in the process of releasing v1.11 is to "elect" a Release Manager. And by "elect" we mean that someone somehow gets appointed to that role, and if they don't want to do it they have to fight a bear. Regards, Zooko Wilcox-O'Hearn Founder, CEO, and Customer Support Rep https://LeastAuthority.com Freedom matters. _______________________________________________ tahoe-dev mailing list tahoe-dev(a)tahoe-lafs.org https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tor-talk] IP Cloaking and the CFAA [Was: Appearing American]
by Eugen Leitl 25 Aug '13

25 Aug '13

----- Forwarded message from Scott Elcomb <psema4(a)gmail.com> ----- Date: Fri, 23 Aug 2013 13:46:51 -0400 From: Scott Elcomb <psema4(a)gmail.com> To: tor-talk(a)lists.torproject.org Subject: [tor-talk] IP Cloaking and the CFAA [Was: Appearing American] Reply-To: tor-talk(a)lists.torproject.org I just ran a quick scan through my mail archives and didn't see this story mentioned. (If it has, apologies for the dup - it was not a thorough scan) IP Cloaking Violates Computer Fraud and Abuse Act, Judge Rules <http://www.wired.com/threatlevel/2013/08/ip-cloaking-cfaa/> "A federal judge has ruled that circumventing an IP address blockade to connect to a website is a breach of the Computer Fraud and Abuse Act, the same law that was used to prosecute Aaron Swartzbefore he committed suicide earlier this year." Best, - Scott On Sun, Aug 18, 2013 at 10:54 AM, B Sairafi <sairafi.b(a)gmail.com> wrote: > Hello > > I'm using Tor Browser, and I need to be seen by a specific website as if > I'm in the US. Is this possible? I mean, is this a feature you already > have? > > I'm sorry if this is the wrong email address, I'm very confused! > > Thanks, > - B > -- > tor-talk mailing list - tor-talk(a)lists.torproject.org > To unsusbscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > -- Scott Elcomb @psema4 on Twitter / Identi.ca / Github & more Atomic OS: Self Contained Microsystems http://code.google.com/p/atomos/ Member of the Pirate Party of Canada http://www.pirateparty.ca/ -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [liberationtech] Bradley Manning's sentence: 35 years for exposing us to the truth
by Eugen Leitl 25 Aug '13

25 Aug '13

----- Forwarded message from Maxim Kammerer <mk(a)dee.su> ----- Date: Thu, 22 Aug 2013 00:27:21 +0300 From: Maxim Kammerer <mk(a)dee.su> To: liberationtech <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Bradley Manning's sentence: 35 years for exposing us to the truth Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> On Wed, Aug 21, 2013 at 11:59 PM, Shelley <shelley(a)misanthropia.info> wrote: > Sure, but I think Manning has a zero chance of obtaining a pardon. Col. Morris Davis: “Military has detailed regs on confinement credits & parole eligibility. My best est is he'll do about 8-9 yrs, out by age 33-34.” https://twitter.com/ColMorrisDavis/status/370223513400913920 https://en.wikipedia.org/wiki/Morris_Davis If true, a pretty fitting sentence, I think, for indiscriminately publishing huge amount of classified information that potentially endangered many people, and considering that USA has unusually harsh sentences for a developed country. An interesting comment on Reddit, of all places: “Significant amounts of foreign service agent names were released. These are civilians working for their government in some official capacity (think spies, except not all of them are cloak and dagger types). These were people stationed in hostile countries (Pakistan, SE Asia, Middle East, Africa) and if their cover had been blown while in country they could have been sought out. Luckily, as I understand it most of the people that were exposed were notified by their handlers in advance (basically as soon as word go out that diplomatic cables had been compromised) and were extracted. A friend of mine works in a field that draws a lot of foreign service agents to it due to the nature of the work, and they were camped out in northern Pakistan with her crew. She woke up one morning (the morning after the diplomatic cables were released) and half her crew was gone. They got word in the middle of the night and left. They couldn't even tell the people they were with why they were gone, and I imagine it was quite unsettling to be there and be missing people all of the sudden.” http://www.reddit.com/r/news/comments/1kszc9/bradley_manning_sentenced_to_3… -- Maxim Kammerer Liberté Linux: http://dee.su/liberte -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [liberationtech] NSA Admits: Okay, Okay, There Have Been A Bunch Of Intentional Abuses, Including Spying On Love Interests | Techdirt
by coderman 24 Aug '13

24 Aug '13

LOVEINT!!! oh god this alone makes it all worth it,,, thank you Snowden! P.S. setup a bitcoin donation address. best regards, On Fri, Aug 23, 2013 at 9:21 PM, Yosem Companys <companys(a)stanford.edu> wrote: > http://www.techdirt.com/articles/20130823/18432024301/nsa-admits-okay-okay-… > > NSA Admits: Okay, Okay, There Have Been A Bunch Of Intentional Abuses, > Including Spying On Love Interests > > from the and-we're-just-now-telling-congress dept > > So, this week, we wrote about the NSA quietly admitting that there had been > intentional abusesof its surveillance infrastructure, despite earlier claims > by NSA boss Keith Alexander and various folks in Congress that there had > been absolutely no "intentional" abuses. Late on Friday (of course) the NSA > finally put out an official statement admitting to an average of one > intentional abuser per year over the past ten years. The AP is reporting > that at least one of the abuses involved an NSA employee spying on a former > spouse. Meanwhile, the Wall Street Journal suggests that spying on love > interests happens somewhat more often: > > The practice isn’t frequent — one official estimated a handful of cases in > the last decade — but it’s common enough to garner its own spycraft label: > LOVEINT. > > A handful is still significantly more than once. And it's a lot more than > the "zero" times we'd been told about repeatedly by defenders of the > program. > > While the NSA says it takes these abuses seriously, there's no indication > that the analyst was fired. > > Much more troubling is that it appears that the NSA only told its oversight > committee in the Senate about all of this a few days ago: > > The Senate Intelligence Committee was briefed this week on the willful > violations by the NSA's inspector general's office, as first reported by > Bloomberg. > > "The committee has learned that in isolated cases over the past decade, a > very small number of NSA personnel have violated NSA procedures — in roughly > one case per year," Sen. Dianne Feinstein, the California Democrat who > chairs the committee, said in a statement Friday. > > Of course, this is the same Dianne Feinstein who, exactly a week ago, said > the following: > > As I have said previously, the committee has never identified an instance in > which the NSA has intentionally abused its authority to conduct surveillance > for inappropriate purposes. > > Yeah. Because apparently the NSA chose not to tell the committee until a few > days later, despite it happening for years. > > And, of course, they release this all on a Friday night, hoping that it'll > avoid the news cycle... > > In the meantime, the NSA just made Senator Feinstein look like a complete > fool. She's been its strongest defender in Congress for years, and has stood > up for it time and time again, despite all of this questionable activity. > Then, last week, it lets her tell lies about it without telling her > beforehand that there had been such abuses. At this point, it's abundantly > clear that Feinstein's "oversight" of the NSA is a joke. She's either > incompetent or lying. Either way, it appears that the NSA is running circles > around her, and isn't subject to any real Congressional oversight. At some > point, you'd think that maybe she'd stop defending it and actually start > doing her job when it comes to oversight. You'd think the fact that it let > her make a complete fool of herself by claiming there had been no > intentional abuses should make Feinstein realize that the NSA situation is > out of control. But, tragically, this seems unlikely. Even her statement > seems to want to minimize the seriousness of the fact that she -- the person > in charge of oversight -- was completely kept in the dark about very serious > intentional abuses. Senator Feinstein just got hung out to dry by the NSA. > You'd think she'd stop going to bat for it and its lies. > > Either way, we've now gone from General Keith Alexander and Feinstein > claiming "no abuses," to them saying no "intentional" abuses, to this latest > admission of plenty of intentional abuses, including spying on lovers. > Perhaps, instead of lying, it's time for the NSA to come clean and to get > some real oversight. > > > -- > Liberationtech is a public list whose archives are searchable on Google. > Violations of list guidelines will get you moderated: > https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, > change to digest, or change password by emailing moderator at > companys(a)stanford.edu.

2 1

Re: [liberationtech] NSA Admits: Okay, Okay, There Have Been A Bunch Of Intentional Abuses, Including Spying On Love Interests | Techdirt
by coderman 24 Aug '13

24 Aug '13

On Fri, Aug 23, 2013 at 10:25 PM, James S. Tyre <jstyre(a)eff.org> wrote: > Best summary: https://twitter.com/slworona/status/370946271646711809 indeed; this codename gives the lie to all the congressional testimony, to all the claims of controls and judiciary oversight, to all the attestations of full compliance. it's beautiful in laying bare the capriciousness to which the entire intelligence juggernaut can be brought to bear against arbitrary individuals; personal pettiness more than sufficient.

1 0