- cypherpunks - lists.cpunks.org

Cryptopolitik and the Darknet
by Steve Kinney 15 Feb '16

15 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cryptopolitik and the Darknet "Encryption is too important to be left to true believers. The future design of crypto systems should be informed by hard-nosed political and technical considerations. A principled, yet realistic, assessment of encryption and technology more broadly is needed, informed by empirical facts, by actual user behaviour and by shrewd statecraft – not by cypherpunk cults, an ideology of technical purity and dreams of artificial utopias. Pragmatism in political decision-making has long been known as realpolitik.80 Too often, technology policy has been the exception. It is high time for cryptopolitik." Spoiler: Onion routing rules, hidden services suck. What's worse, the authors back this with empirical evidence. http://www.tandfonline.com/doi/full/10.1080/00396338.2016.1142085#ab stract - or - https://tinyurl.com/cryptopolitik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJWwdnBAAoJEDZ0Gg87KR0LTqAQAJjrSpHA59fYzYikhDu1whG5 OqEUYZHcy4mQF/Q3rcocBRjRih1dJ+3w1O43BvpBN0GvyfrcnwUskLW0u+biGGbm ju4YQCGILR7LPUN8oNJImdiQv2r4on+4khCMsc2NrBB6ppyPhVHa0ydBx4avL6Uy Ipu+6vX9JB+8IPkB+MYpBz34iypsU72+4V9U0OnEhs+91++Lm1GI2BxBv3h0yYXk JjviKGNPBT9dR+IcjtQNiWUz+aThKJHYlF9neKtpgP4W4+OGJFHGjy4PXX+KoQVQ aWimX8jP8zs6mS3eIy+xvLB0qM7Xj5yrpXF1pZZ80kdvS2T7nbl2/iQ3YeM1IyT8 s1yln5zl1s0MYSXrPWO5S/nr78OmkER8v9UfVCkhlKb05AM7JktulFhysMfUMnbZ 2VTM5BhjCf6rg0ipEgLgq24koRhKprmurmkF6qfrCZAKy3s3KGmQ4fZTOY9sySYs fNb4ow0FEQTZ1pVu7GO6z1epO1qBibFDbfklpEMN17Lchc0mVHfRyGvJ40GMmclp sqYttpd/+iVzk+wamYMDdxypjLjrv8Lf1PN3BNTRALCGbZAC8OOenzZWsNz4is7C lxZBgMy4x5CfPfTj2CRd4PJc+hI89AEW8BUc5trgiTVyqMFniXiJ3goaLqKcprKi jX5fk4Wh3Zd4U/J5DD3n =8+ez -----END PGP SIGNATURE-----

1 0

Samsung Warns Customers: Watch Your Mouth
by grarpamp 15 Feb '16

15 Feb '16

---------- Forwarded message ---------- From: "ECOTERRA Intl." <office(a)ecoterra-international.org> Date: Sun, 14 Feb 2016 11:13:25 +0300 Subject: [NATURAL_DEFENCE] Samsung Warns Customers To: MAILHUB <mailhub(a)ecoterra.net> * **Samsung Warns Customers To Think Twice About What They Say Near Smart TVs* By *Jake Anderson <http://theantimedia.org/team/jake/>**- February 12, 2016* *(**ANTIMEDIA* <http://theantimedia.org/>*)* /—/ In a troubling new development in the domestic consumer surveillance debate, an investigation into Samsung Smart TVs has revealed that user voice commands are recorded, stored, and transmitted to a third party. The company even warns customers not to discuss <http://theweek.com/speedreads/538379/samsung-warns-customers-not-discuss-pe…> personal or sensitive information within earshot of the device. This is in stark contrast to previous claims by tech manufacturers, like Playstation <http://www.polygon.com/2013/11/5/5054400/can-your-xbox-one-spy-on-you>, who vehemently deny their devices record personal information, despite evidence to the contrary, including news that hackers can gain access <http://www.geek.com/games/playstation-3-is-biggest-spy-ever-says-hacker-tra…> to unencrypted streams of credit card information. The new Samsung controversy stems from the discovery of a single haunting statement in the company’s “privacy policy,” which states: /“Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.”/ This sparked a back and forth between the /Daily Beast/ <http://www.thedailybeast.com/articles/2015/02/05/your-samsung-smarttv-is-sp…> and Samsung regarding not only consumer privacy but also security concerns. If our conversations are “captured and transmitted,” eavesdropping hackers may be able to use our “personal or other sensitive information” for identity theft or any number of nefarious purposes. There is also the concern that such information could be turned over to law enforcement or government agencies. With the revelation of the PRISM <http://techreport.com/news/24923/nsa-prism-program-collecting-data-from-mic…> program /—/ by which the NSA collected data from Microsoft, Google, and Facebook /— /and other such NSA spying programs <https://www.eff.org/nsa-spying/timeline>, neither the government nor the private sector has the benefit of the doubt in claiming tech companies are not conscripted into divulging sensitive consumer info under the auspices of national security. Michael Price <http://www.thedailybeast.com/articles/2015/02/05/your-samsung-smarttv-is-sp…>, counsel in the Liberty and National Security Program at the Brennan Center for Justice at the NYU School of Law, stated: /“I do not doubt that this data is important to providing customized content and convenience, but it is also incredibly personal, constitutionally protected information that should not be for sale to advertisers and should require a warrant for law enforcement to access.”/ Responding to the controversy, Samsung updated its privacy policy, named its third party partner, and issued the following statement: /“Voice recognition, which allows the user to control the TV using voice commands, is a Samsung Smart TV feature, which can be activated or deactivated by the user. The TV owner can also disconnect the TV from the Wi-Fi network.”/ Under still more pressure, Samsung named <http://www.newsweek.com/samsung-updates-smarttv-policy-names-third-party-co…> its third party affiliate, Nuance Communications. In a statement to /Anti-Media/, Nuance said: /“Samsung is a Nuance customer. The data that Nuance collects is speech data. Nuance respects the privacy of its users in its use of speech data. Our use of such data is for the development and improvement of our voice recognition and natural language understanding technologies. As outlined in our privacy policy, third parties work under contract with Nuance, pursuant to confidentiality agreements, to help Nuance tailor and deliver the speech recognition and natural language service, and to help Nuance develop, tune, enhance, and improve its products and services./ /“We do not sell that speech data for marketing or advertising. Nuance does not have a relationship with government agencies to turn over consumer data…..There is no intention to trace these samples to specific people or users.”/ Nuance’s Wikipedia page <https://en.wikipedia.org/wiki/Nuance_Communications> mentions that the company maintains a small division for government and military system development, but that is not confirmed at this time. Despite protestations from these companies that our voice command data is not being traced to specific users or, worse, stored for use by government or law enforcement agencies, it seems that when it comes to constitutional civil liberties, the end zone keeps getting pushed further and further down the field. For years, technologists and smart device enthusiasts claimed webcam and voice recording devices did not store our information. While Samsung may be telling the truth about the use of that data, there are countless companies integrating smart technology who may not be using proper encryption methods and may have varying contractual obligations to government or law enforcement. Is it really safe for us to assume that the now exceedingly evident symbiotic relationship between multinational corporations and government agencies does not still include a revolving door for the sharing of sensitive consumer data? ------------------------------------------------------------------------ /This article (//Samsung Warns Customers To Think Twice About What They Say Near Smart TVs/ <http://theantimedia.org/samsung-warns-customers-to-think-twice-about-what-t…>/) is free and open source. You have permission to republish this article under a //Creative Commons/ <http://creativecommons.org/licenses/by/4.0/>/license with attribution to //Jake Anderson <http://theantimedia.org/author/jake1/> //and //theAntiMedia.org/ <http://theantimedia.org/about>/. //Anti-Media Radio/ <http://theantimedia.org/radio/>/airs weeknights at 11pm Eastern/8pm Pacific. If you spot a typo, email //edits(a)theantimedia.org//. //======== * * *Pro-active work to protect nature and human rights requires YOU to work with us* *Even if you have no possibility to be at the front-lines with us, please know we need independent funding.** * *PLEASE consider to contribute to ECOTERRA's work and trust fund. * ------------------- *ECOTERRA Intl.* /***SURVIVAL & FREEDOM for PEOPLE & NATURE*/ ----------------- Our full footer, being an essential, legal part of this dissemination, can be found at http://www.ecoterra.net/footer.htm - please read it at least once a month to see important security updates. ---------------------- ***ECOTERRA Intl. nodes:* Canaries - Cairns - Cairo - Calgary - Cape Town - Cassel - Cebu - Cork - Curitiba - London - Los Angeles - Nairobi - Roma - Paris - Reykjavik - Stuttgart - Wien - Vanuatu ECOTERRA - FIRST PEOPLES & NATURE FIRST! http://www.ecoterra-international.org 24 h EMERGENCY RESPONSE PHONE LINE: +254-714-747-090 Marine Group:http://www.ecop.info/

4 3

Personal Location Logging Apps (with Notary options)
by grarpamp 15 Feb '16

15 Feb '16

http://www.spotmarksthetax.com/ In order of increasing power consumption, Spot takes three kinds of location fixes: a Venue Fix, a Tracking Fix, and a Fingerprint Fix. Venue fixes have an entry time and a duration. For example, say you were visiting a client’s office for an hour long meeting. Spot would take a fix about 5-15 minutes into the meeting and a second fix roughly 5-15 minutes after you’ve left the office to declare a venue fix of your location, time and duration, perhaps for 67 minutes and 13 seconds. A Venue fix exploits Apple’s location database of both cell towers and Wi-Fi access points. While these are not as precise as GPS measurements, in practice, they are quite good. We believe that these fixes alone are sufficient to handle most tax residency issues. Consuming a bit more power are the optional Tracking fixes. These fixes are calculated when the phone switches cell phone towers. While they typically have an accuracy radius of about a kilometer, they are also, in practice, quite accurate in showing the progress of your day. Finally, a Fingerprint fix, which is taken by running the app and pressing the fingerprint icon in the upper left corner, uses the GPS to record your position with the highest resolution possible. When you need to prove that you have crossed that state line before midnight, the Fingerprint fix is what you want to use. Since its accuracy radius can be as large as 65 meters, more than half a football field long, make sure you are significantly past the state line when you take the fix.

1 0

Brit spies can legally hack PCs and phones, say Brit spies' overseers
by Georgi Guninski 14 Feb '16

14 Feb '16

http://www.theregister.co.uk/2016/02/12/uk_rules_gchq_hacking_legal/ Brit spies can legally hack PCs and phones, say Brit spies' overseers

5 4

USA ENCRYPT Act
by grarpamp 14 Feb '16

14 Feb '16

http://arstechnica.com/tech-policy/2016/02/house-bill-would-kill-state-loca… https://www.reddit.com/r/gadgets/comments/4537ug/us_house_encrypt_act_would…

1 0

Austria to make Right To Pay In Cash
by grarpamp 14 Feb '16

14 Feb '16

http://yro.slashdot.org/story/16/02/12/1547203/austrian-minister-calls-for-… Extend to BTC.

1 0

The Iran-Contra White House Emails
by Michael Best 14 Feb '16

14 Feb '16

Since it's coming up in some of my historical research, and definitely relevant with all of the HRC email stuff in the news right now, I thought I'd check and see if anyone here happens to know what agency has custody of the 3,000 White House emails that were released to the NSArchive after their lawsuit. About 250 were published by NSArchive, but the rest haven't been made available yet. If anyone happens to know what agency has them, let me know. I'd love to get my hands on them. My initial check with NARA shows only the million restricted emails held by the GHWBush Presidential Library, but I'll check with the archivists at NARA II next week. Let me know if you have any leads! -Mike

1 0

Small codebase as a prerequisite for security
by Sean Lynch 13 Feb '16

13 Feb '16

I laughed out loud when I read on the Invisible Things Labs' Blog that Xen is "only" a "few hundreds of thousands of lines of code."[1] Sure, this is small compared to most modern monolithic desktop OSes, but it's not particularly small compared to a stripped down Linux kernel build, and it's absolutely gigantic compared to a modern microkernel. The Nova Microhypervisor and seL4 are each about 9000 SLOC. But when I shared this disbelief with a couple of friends who at least have a passing understanding of computer security, each of them just shrugged. And of course both Nova and seL4 have had a lot of trouble gaining any kind of foothold in the market. Am I completely off base in thinking that it should be self-evident that one should start building any secure system by minimizing the size of their trusted computing base? Or is the issue that applications are still the source of most vulnerabilities, so it's premature to try to make the kernel super secure? Or that there are too many ways to violate isolation in a microkernel by compromising shared server processes? I ask because I am wondering if I should "learn to stop worrying and love the bomb" and (re-)embrace Xen and/or Linux, or if I should continue pursuing some approach along the lines of seL4/Nova/Genode for building secure systems? [1] http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-different-fr…

2 4

Fwd: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet)
by grarpamp 12 Feb '16

12 Feb '16

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, 11 Feb 2016 12:59:38 -0800 Subject: Re: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet) To: Phillip Hallam-Baker <phill(a)hallambaker.com> Cc: cryptography(a)metzdowd.com At 08:49 PM 2/9/2016, Phillip Hallam-Baker wrote: >Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet) > >A) Assume that the NSA has such a machine. I think that someone at NSA invented Bitcoin to supercharge the development of fast encryption/decryption chips. New forms of QC-resistant XXXcoins will be developed for similar reasons. How to leverage NSA's research $$$$$$$$$$$'s. It seems to have worked! Recall that "miners" get paid in Bitcoin, but chip developers get paid in real $$$. Algorithm/SW developers don't need to get paid at all, because they do it for the love of computer science, society and world peace. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

3 2

Re: [Cryptography] Proof that the NSA does not have a quantum computer capable of attacking public key crypto (yet)
by grarpamp 12 Feb '16

12 Feb '16

On 2/11/16, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > On Thu, Feb 11, 2016 at 2:12 PM, John Levine <johnl(a)iecc.com> wrote: >>>A,B) Anyone with a QC could use it to break the keys of the wallets >>>holding $500 million. >> >> Which is under 5% of the NSA's annual budget. Also keep in mind that >> bitcoins are extremely illiquid. The largest bitcoin transaction I >> can find where the buyer got something of identifiable value was a >> $500K villa in Bali. (The so-called $147M transaction doesn't count >> since there's no evidence of goods or services on either side of it.) >> Fencing a thousand villas seems pretty hard. >> >> If I wanted to use my NSA connections or my quantum computer to enrich >> myself, this doesn't strike me as a particularly good way to go. > > I was asserting that the funds would be diverted for personal > purposes, not to fund the agency. > > $500 million might be chump change to the agency but Hanssen defected > for a lot less. There is only one purpose for an entity to crack any currency and that's to kill it. Because any cracked wallets would instantly make worldwide headlines and the currency would go to zero within a day. Depending on the speed of the adversary, you might be able to migrate crypto fast enough to save some wallets but the losers will be throwing realworld pitchforks, that will roll all the way up the legal politik chain until the pressure is unbearable. The entity isn't going to be able to recoup its costs in a zero market. Even cracking supposedly dead wallets is risk of zero without proof of deadness, granny might still have her mitts on them and be watching every day. Since an entity full of people is unlikely to be able to keep a secret kill secret, they'd be better off accelerating mining, selling in a stable market. Perhaps that's what's happening now... ;) http://bitcoin.sipa.be/ If an entity has a crack it probably can't use it, and the same scenario applies if a rogue within it appropriates it for their own purposes. And for any independant loner who discovers it. They only have odds at a few wallets before they hit the wrong one and news breaks. And for them it will be all about the lulz. Either way, digital currencies will come and go, and are here to stay. Unless Bitcoin solves its serious scalability and anonymity issues, people will probably be slowly trading out of it into something else within the next 5-10 years anyway. If that something else is significantly better and stronger, you might see some cracking then in attempt to cash out. BTC from 1250 to sub 200 didn't seem to trigger any.

1 0