- cypherpunks - lists.cpunks.org

But you knew that right? "Your 'Anonymous' Browsing Data Isn't Actually Anonymous"
by Razer 05 Aug '17

05 Aug '17

> Eckert's first task with the data was to find out if her browsing data > was included in the dataset. To do this, she queried the data for the > URL linked with her company's login page, which generates a unique ID > for each employee. Germany has a population of about 82 million, so > the odds that Eckert herself was in browser data collected from 3 > million Germans was small. Although it turned out her browser history > wasn't in the data set, by querying the data for her company's login > page Eckert discovered that a number of her colleagues were in the > data by matching the unique login IDs from the company's page to the > individuals. > > With this information, Eckert would've been able to see her > colleagues' entire browsing history for the last month. One of the > colleagues included in the dataset was a close friend of hers, and she > reached out to him to let him know that she had his browsing history. > The question she had was which browser plugin was collecting and > selling this data. > > To answer this question, Eckert had her colleague delete one browser > plugin every hour until he disappeared from the live data. On the > seventh plugin, he disappeared. This suggested that the plugin > collecting and selling his browser data was, ironically enough, called > Web of Trust, which offers "free tools for safe search and web browsing." > > The troubling thing about Eckert and Dewes' de-anonymization technique > is that it can be used on anyone who has a public social media > presence. For their report, Eckert and Dewes focused on Twitter and > the German LinkedIn equivalent, Xing, to see if they could use these > public profiles to de-anonymize public figures in the data. > > When you click on your analytics page on Twitter, this brings you to a > URL that includes your public Twitter handle—Xing has a similar > feature. This means that Eckert and Dewes were able to query the > database for these publicly available Twitter URLs for German politicians. > > If the politicians were included in the dataset, the next step was to > visit the Twitter profile of the politician and collect a few of the > links they had recently posted. By using these links, coupled with the > public Twitter URL, Eckert and Dewes were able to pull an individual's > entire month-long browsing history from the anonymous dataset. > > As Dewes pointed out when he and I spoke at Def Con, it requires an > astonishingly small amount of browsing information to identify an > individual out of an anonymous dataset of 3 million people. Since > everyone's browsing habits are unique, it only takes about 10 website > visits to create a "fingerprint" for an individual based on which > websites they are visiting and when. > https://motherboard.vice.com/en_us/article/gygx7y/your-anonymous-browsing-d…

3 4

L4nguage and anonymity
by Georgi Guninski 04 Aug '17

04 Aug '17

L4nguage and anonymity: http://www.theregister.co.uk/2017/08/04/to_preserve_online_anonymity_make_y… https://arxiv.org/pdf/1707.03736.pdf

3 2

Re: [Cryptography] How to find hidden/undocumented instructions
by grarpamp 04 Aug '17

04 Aug '17

On Fri, Aug 4, 2017 at 10:29 AM, Kevin W. Wall <kevin.w.wall(a)gmail.com> wrote: > researchers commitment to full disclosure has now revealed > to Skynet Intel's secret plans to destroy our future AI > overlords using this undocumented, unprivileged "halt and One might expect a set of hard to find random opcodes, or some other trigger, and for Skynet's embeds to already know about most of them. #OpenFabs, #OpenHW

1 0

Re: [Cryptography] How to find hidden/undocumented instructions
by grarpamp 03 Aug '17

03 Aug '17

On Wed, Aug 2, 2017 at 9:17 AM, Henry Baker <hbaker1(a)pipeline.com> wrote: > https://raw.githubusercontent.com/xoreaxeaxeax/sandsifter/master/references… > > Breaking the x86 ISA > Christopher Domas xoreaxeaxeax(a)gmail.com July 27, 2017 > > A processor is not a trusted black box for running code; on the > contrary, modern x86 chips are packed full of secret instructions and > hardware bugs. In this paper, we demonstrate how page fault analysis > and some creative processor fuzzing can be used to exhaustively search > the x86 instruction set and uncover the secrets buried in a chipset. > The approach has revealed critical x86 hardware glitches, previously > unknown machine instructions, ubiquitous software bugs, and flaws in > enterprise hypervisors. "Lastly, a so-called `halt and catch fire' instruction was discovered on an as-yet unnamed x86 processor. This instruction, executed in ring 3 from an unprivileged process, appears to lock the processor entirely. To rule out kernel bugs, the instruction was tested against three Linux kernels and two Windows kernels, yielding the same results. Kernel debugging with serial I/O and interrupt hooks appeared to corroborate the results. At the time of this paper's publishing, the vendor has not been provided sufficient time to respond to the issue." This is nice work. These sort of fuzzers and searchers need a distributed network version to cover more space deeper and faster.

1 0

Strong Crypto Kit [was: Enigma kit]
by grarpamp 03 Aug '17

03 Aug '17

On Wed, Aug 2, 2017 at 5:34 AM, Peter Gutmann <pgut001(a)cs.auckland.ac.nz> wrote: > https://www.tindie.com/products/lpaseen/meinenigma-hybrid-kit/ > > This is an electronic replica of the Enigma crypto machine used during WWII > by the Germans to encrypt all the military communications. It is intended to > be as close to the real one as economically possible. While cool, at the end of the day it implements broken crypto, on relatively closed inauditable core chip. So it's an unusable coffee table conversation piece. Why not put the $300 towards an open discrete implementation of at least some well known secure symmetric cipher, buildable in a year or so of casual hobby time. Or even order it premade so long as full audit and test vector is completable similarly by self. A contract investment by builders in cryptocurrency could pay for the design dev and parts making things basically free. #OpenFabs #OpenHardware Why? Because cryptos should give a fuck... https://bitcointalk.org/index.php?topic=1945661.0

1 0

About Set 8 of Cryptopals Crypto Challenges
by g4z3 03 Aug '17

03 Aug '17

Hi, guys Does anybody know how to the contents of Set 8 in Cryptopals Crypto Challenges? I've accomplished Set 1 through 7, and now it seems I need to send an email to them to get Set 8. However, the given mail address never replied. Regards, -- g4z3 Pub Key: http://keys.gnupg.net/pks/lookup?op=get&search=0x51915C417BFEAB2F

1 0

Bitcoin Blockchain Has Been Forked (New: BitcoinCash UAHF)
by grarpamp 03 Aug '17

03 Aug '17

The longest running most successful blockchain and cryptocurrency in history (Bitcoin BTC/XBT) has finally been forked, for the first known time, at last common block 478558, resulting in the new BitcoinCash UAHF (BCC/BCH). https://bitcoincash.org/ https://github.com/Bitcoin-UAHF https://www.reddit.com/r/Bitcoincash https://twitter.com/search?q=$BCC https://twitter.com/search?q=$BCH "Frontpage: On August 1st 2017, We the People will breathe new life into Bitcoin. A group of miners, developers, investors, and bitcoin users will upgrade the Bitcoin protocol as specified by the User Activated Hard Fork (UAHF). Those who do not want to follow our lead are free to use whichever chain they like. Miners implementing the UAHF will safely split away, creating a new version of Bitcoin called "Bitcoin Cash". All current Bitcoin holders will automatically own Bitcoin Cash. The existing ledger at the time of the split is preserved, thus users retain any balances they had before the split. Bitcoin Cash brings sound money to the world. Merchants and users are empowered with low fees and reliable confirmations. The future shines brightly with unrestricted growth, global adoption, permissionless innovation, and decentralized development. These ideals can be achieved, but it depends on you to succeed. We need the support of miners, investors, and users like you. Join us to help achieve Satoshi's original vision of Bitcoin as Peer-to-Peer Electronic Cash. " https://www.reddit.com/r/Bitcoin+btc+CryptoCurrency+bch++bcc+bcash/ https://medium.com/@johnblocke/bring-on-the-chain-split-8a295a62cee6 https://medium.com/@jgarzik/bitcoin-is-being-hot-wired-for-settlement-a5beb… https://coingeek.com/core-think-bitcoin-cash/ https://coinmarketcap.com/ https://bitcointalk.org/

3 8

Global Internet CounterTerrorism Forum: Govs, Corps, BigSocial Conspiring: Spy Privacy, CensorKill Speech and Crypto, Repeal Provider Exemption
by grarpamp 03 Aug '17

03 Aug '17

http://www.bbc.com/news/technology-40788180 http://www.businessinsider.com/home-secretary-amber-rudd-real-people-dont-n… https://news.slashdot.org/story/17/08/01/1924247/real-people-dont-need-end-… UK home secretary Amber Rudd has called on messaging apps like WhatsApp to ditch end-to-end encryption, arguing that it aids terrorists. From a report: The major technology companies must step up their fight against extremism or face new laws, the home secretary has told the BBC. Amber Rudd said technology companies were not doing enough to beat "the enemy" on the internet. Encryption tools used by messaging apps had become a "problem," she added. Ms Rudd is meeting with representatives from Google, Facebook, Twitter, Microsoft and others at a counter-terrorism forum in San Francisco. Tuesday's summit is the first gathering of the Global Internet Forum to Counter Terrorism, an organisation set up by the major companies in the wake of recent terror attacks. In a joint statement, the companies taking part said they were co-operating to "substantially disrupt terrorists' ability to use the internet in furthering their causes, while also respecting human rights." In an op-ed, she wrote Tuesday: Real people often prefer ease of use and a multitude of features to perfect, unbreakable security ... Who uses WhatsApp because it is end-to-end encrypted, rather than because it is an incredibly user-friendly and cheap way of staying in touch with friends and family? Companies are constantly making trade-offs between security and 'usability,' and it is here where our experts believe opportunities may lie. https://www.usatoday.com/story/news/2017/08/01/alter-internet-laws-hold-bac… https://yro.slashdot.org/story/17/08/01/1959234/senators-propose-bill-targe… A bipartisan group of lawmakers introduced legislation Tuesday that aims to make it easier to sue and criminally prosecute operators of online classified sites like Backpage.com that have been used to advertise sex workers. The proposed bill would amend the Communications Decency Act to eliminate a provision that shields operators of websites from being liable for content posted by third-party users. In addition to removing liability protections for websites that facilitate "unlawful sex acts with sex trafficking victims," lawmakers are seeking to amend the CDA to allow state prosecutors -- not just federal law enforcement -- to take action against individuals and businesses that use websites to violate federal sex trafficking laws. "For too long, courts around the country have ruled that Backpage can continue to facilitate illegal sex trafficking online with no repercussions," said Sen. Rob Portman, R-Ohio. "The Communications Decency Act is a well-intentioned law, but it was never intended to help protect sex traffickers who prey on the most innocent and vulnerable among us. This bipartisan, narrowly crafted bill will help protect vulnerable women and young girls from these horrific crimes." https://www.theguardian.com/technology/2017/aug/01/google-says-ai-better-th… https://news.slashdot.org/story/17/08/01/2046215/google-says-ai-better-than… Google has pledged to continue developing advanced programs using machine learning to combat the rise of extremist content, after it found that it was both faster and more accurate than humans in scrubbing illicit content from YouTube. The company is using machine learning along with human reviewers as part of a mutli-pronged approach to tackle the spread of extremist and controversial videos across YouTube, which also includes tougher standards for videos and the recruitment of more experts to flag content in need of review. A YouTube spokesperson said: "While these tools aren't perfect, and aren't right for every setting, in many cases our systems have proven more accurate than humans at flagging videos that need to be removed. Our initial use of machine learning has more than doubled both the number of videos we've removed for violent extremism, as well as the rate at which we've taken this kind of content down. Over 75% of the videos we've removed for violent extremism over the past month were taken down before receiving a single human flag." https://apple.slashdot.org/story/17/07/29/2338204/apple-pulls-anti-censorsh… https://www.nytimes.com/2017/08/01/business/amazon-china-internet-censors-a… https://www.reuters.com/article/us-amazon-china-vpn-idUSKBN1AI0CM

3 2

Legal Wonk Cybercrime Roundup: International Takedown of Two Online Illicit Marketplaces
by Razer 03 Aug '17

03 Aug '17

Don't troll me #$%$&@! .. > Purportedly a guide to accessing and safely using AlphaBay, > Alphabaymarket.com provides tips to help AlphaBay users protect their > anonymity. Those tips include the following: > > [image] > > If Alexandre Cazes, the alleged owner and operator of AlphaBay, had > taken those steps seriously, his own anonymity might still be intact. > > Cazes’ mistakes involved his use of several different online > identifiers on both AlphaBay and elsewhere on the web: the monikers > “Alpha02” and “Admin,” the email “Pimp_Alex_91(a)hotmail.xn--com,-jb7a and a > company called EBX Technologies (EBX Tech). By using several of these > identifiers on other sites outside AlphaBay, he left a trail of > breadcrumbs to his true identity. . . . > Once AlphaBay was shut down on July 5th, users, in the words of Acting > Director McCabe “flocked” to another online illicit marketplace—Hansa. > According to a Europol press release, Hansa saw an eightfold increase > of new members after AlphaBay went down. Unbeknownst to the users, > however, the Dutch National Police had covertly taken control of Hansa > since June 20, 2017. This allowed for collection of intelligence not > only on Hansa users but also on those who were driven from AlphaBay. > From the Europol press release, it appears not only that significant > intelligence was collected but also that it was shared with the > international coalition that coordinated to produce this > unprecedented double takedown. > > > > Looking Ahead > > This takedown can be read as touching several of the Department of > Justice’s priorities. First, it has consistently emphasized the > importance of taking down criminal computer networks and their > operators... > > In full with links: > https://lawfareblog.com/cybercrime-roundup-international-takedown-two-onlin…

2 1

the intercept - yet another pentagon propaganda outlet
by juan 03 Aug '17

03 Aug '17

But no, actually, the intercept is on a class of its own. While all of the US media doesn't pretend to be anything but the government's department of fascist propaganda, greenwald has promoted himself as the good guy...and that's something which, when you look at the evidence, is clearly a deranged pretense. https://theintercept.com/2017/08/02/white-house-says-russias-hackers-are-to…

3 2