- cypherpunks - lists.cpunks.org

yahoo encryption article
by jim bell 08 Dec '15

08 Dec '15

https://www.yahoo.com/tech/faq-how-encryption-works-and-why-people-are-so-1… Encryption has been all over the headlines after recent terrorist attacks, and the discussion can quickly get cryptic. Is “crypto” a fatal weakness of the Internet? An endangered species that must be saved? You can hear heartfelt testimony for either view from both Democratic and Republican politicians. But ultimately, encryption is just math that, like any other tool, can be used for good or ill. Let’s start with some basics about it that often get neglected in all the commentary. Q. It was my understanding there would be no math in this story…? A. Sorry, it’s unavoidable: Encryption works by encoding information in such a way that its recipient can decode it (without further help from its sender), but no one else can. To do that scrambling, you need to run the original data through one equation or another. For example, to encrypt something against the prying eyes of somebody who’s really, really drunk, you could just replace each letter with one 13 places forward (so “A” becomes “N” and so on). If your eavesdropper is more capable, you’ll need something more complicated — but it’s still all equations. Q. Okay. What makes for strong cryptography? A. Using more complex math in an encryption algorithm only goes so far if the sender and recipient use the same key — that is, if they both plug the same secret set of digits into the encryption formula — to encrypt and decrypt. In that case, if either party loses the key, game over.

1 0

Donald Trump Wants to Shut Down the Internet
by Mike Duvos 08 Dec '15

08 Dec '15

[Hours after Donald Trump <http://www.dailydot.com/tags/donald-trump/> suggested the U.S. ban Muslims from entering the United States <http://www.dailydot.com/politics/donald-trump-shutdown-all-muslim-immigrati…>, the leading Republican presidential candidate said America should also consider “closing the Internet up in some way” to fight Islamic State <http://www.dailydot.com/tags/isis/> terrorists in cyberspace. Trump mocked anyone who would object that his plan might violate the freedom of speech, saying “these are foolish people, we have a lot of foolish people.” “We have to go see Bill Gates,” Trump said, to better understand the Internet and then possibly “close it up.”'] http://www.dailydot.com/politics/trump-closing-the-internet-up-in-some-way/ Trump has finally jumped the shark. -- Mike Duvos mpd(a)wolf359.net

2 1

Re: [tor-talk] LeMonde: France To Block Tor
by grarpamp 08 Dec '15

08 Dec '15

On Mon, Dec 7, 2015 at 11:09 PM, Jonathan Wilkes <jancsika(a)yahoo.com> wrote: > Say a well-funded attacker takes the Carnegie Mellon deanonymization attack and introduces Sybil slowly over several months. The graph would look like this... https://metrics.torproject.org/networksize.html?graph=networksize&start=200… > What then is the defense? Pray.

1 1

Fwd: [Cryptography] Obama calls out encryption in terror strategy speech
by grarpamp 08 Dec '15

08 Dec '15

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Mon, Dec 7, 2015 at 8:48 AM Subject: [Cryptography] Obama calls out encryption in terror strategy speech To: cryptography(a)metzdowd.com FYI -- http://www.theregister.co.uk/2015/12/07/obama_encryption_policy_change_in_t… Obama calls out encryption in terror strategy speech President wants 'high-tech leaders to make it harder for terrorists to use technology to escape from justice' 7 Dec 2015 at 05:20, Simon Sharwood United States President Barack Obama has given just his third Address to the Nation from behind his desk at the Oval Office, to deliver a speech in which he all-but-called-on the technology industry to allow access to encrypted communications. The main purpose of the speech was to offer a response to last week's killings in San Bernadino. Obama said investigations have found “no evidence that the killers were directed by a terrorist organization overseas, or that they were part of a broader conspiracy here at home” but did label "an act of terrorism" committed by people who "... had gone down the dark path of radicalization, embracing a perverted interpretation of Islam that calls for war against America and the West." The speech goes on to say that "as the Internet erases the distance between countries, we see growing efforts by terrorists to poison the minds of people like the Boston Marathon bombers and the San Bernardino killers." Obama therefore explains the USA's immediate response to terrorism and particularly to ISIL, including military and diplomatic efforts, plus some restrictions on the right to purchase firearms and stronger screening of some visitors to America. Future actions, Obama said, will include an attempt to "urge high-tech and law enforcement leaders to make it harder for terrorists to use technology to escape from justice." The sentence isn't explained, but seems a clear reference to the technology industry's argument that encryption is essential for everyday life and therefore ought not to be equipped with back doors for government use. The term "escape from justice" also invokes a New York Times op-ed titled When Phone Encryption Blocks Justice. Penned by Manhattan district attorney, Cyrus R. Vance Jr, Paris chief prosecutor François Molins, commissioner of the City of London Police Adrian Leppard and chief prosecutor of the High Court of Spain Javier Zaragoza, the piece argued that "The new encryption policies of Apple and Google have made it harder to protect people from crime." Similar arguments emerged after the November 13th Paris attacks, when it was widely argued that the attacks may have been detected, and prevented, if law enforcement agencies had access to backdoors allowing easier and wider surveillance of encrypted communications services. Obama's speech is something of a reversal, as he's previously resisted calls for access to encrypted communications. Hillary Clinton, however, has called for Silicon Valley to "develop solutions that will both keep us safe and protect our privacy," adding that "Now is the time to solve this problem, not after the next attack." Clinton's remarks were made in the days between the Paris and San Bernardino incidents. -----BEGIN NSA SPEEDBUMP:I AM SPARTACUS----- Is it just /dev/random ? Only the NSA can tell. 2F795C65C3F925BFEF91EAEA8F1311117B68FE6540947EF54D2CE7A89F98ED45E0711AD518C5B585CBD6B366EE26B9E75F429804FA6D6A93A88DF5A43ED22FA4 763F4CB0A6CDC1D24649B8F3548AD9251D70FE89B6A97774AAACB5CCC8D5EC19C0EA06C99BAB94DF07EAF78143D5A6FF2D562524907DE35E6C91E94D2680CB1B 5A1EB0D7029E135D44E1E850742416D7F6ABF575BB08B27D91ABCEF85937A6B8D173A36C41A9950D0434B021EE0B809E0F5EABE5265B7BAABA004136974F12C5 AE35AFB1E3D3212E44FF09B18FEA4191F92F9584158549D89245A3ECDECCD3F252DE40F04F0E915FE095F5A0BF4825DB2FD238007D7DDEE26852DFA087EB425C E96070F0DA194424714487C90AB60D7F2A08BE5608B1277A5AC4B6436E4007A6A02F8F316A644A8F660D7C1FDD8F4D2761AB2599778F5AEFC52F8FD5D25EF802 458315B3614BEDAFBDBD9B2AD42A71ACB66FE1F808BE2432292DEC11DEB526261C8BBA9D4F2ED52BB282B3A1786777BA62029671CCFF2D0AA5E287AF85B71D02 BB216C934F867F98A743CA85BB72DFDBBE2799100435E686020855C4495257554AB06741B25607328018498F65B54056D258B2854A60D1A7035E1A490BC9A8AE 8E9D97B514BEB63DA838944F8F994188F4F1242361E97D706682E0D01EC7251745DBFFE0C923CB23EA62EE8C40A45F28F3558044AFD8D6D9AF09B343579492E7 3F45A0CCEF3540B05254D3D87E631D2639C682C641ACA85E8079B21F8023CAB75A4FB91D74A45F1E993ACAE914B7DA4AC42EFFE521CE6391440D33700AF14DD1 B1F69E968DD11D066154DABAB3C92C6DAE6A378936BE96B728DA3C376945793DDDBE426C17D53CFDB7D4E52B1261F899FBEE6BA5D3BB6ECE510ED8B409350E3B 9D03AD2715DBA8D8F9E4461E7FA0787278E36CAF20E108C9611D1FAA54E6B33800DA94FE24E80DEE73CBADC7447F153360B9B437D6A45291582DDE6F61E56131 E503366C66EF82E0B16098ED73006FFAA98D85C22143BBBB97FC4A2020D84D452F59DA915CE1830126E81A410CF3EB2BB83D98E7F4274B197C436C0BD6CD9013 665E15C72D717863EFAF1B3AB518BBA8C03503DCEDFBBE034BFB3A9AC6F8245F7649F32A927F0D212200BB3E2AFFC0A606E90CB34B4F290DCAC0086161222DDB C913A6F28F537D46 -----END NSA SPEEDBUMP----- _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

LeMonde: France To Block Tor
by grarpamp 08 Dec '15

08 Dec '15

http://motherboard.vice.com/read/after-paris-attacks-proposed-french-law-wo… French law enforcement wish to “Forbid free and shared wi-fi connections” and “to block or forbid communications of the Tor network.”

2 2

The art of trolling at the highest political levels
by Zenaan Harkness 08 Dec '15

08 Dec '15

Credit where credit's due. Perhaps others will find this chuckle worthy: http://russia-insider.com/en/politics/turkey-plays-poker-bosphorus-putin-do… Statesman, bare chested military strongman, international comedian. Entertainment don't get much better than this. Z

2 1

Fwd: [ PFIR ] MS is ramping up their criminal Windows 10 upgrade scheme
by Zenaan Harkness 07 Dec '15

07 Dec '15

Seriously, why the hell help Microsoft lift their game by involving the FTC or any other government body! Leave them be. Help people who get stung to find a new and partly free world of libre software. A better Windows OS harms the cause for libre software, does not help us. We live in a world where government is decrepit, corporations are corrupt in their manifestation in the world, and even small decisions we techies make, can have big consequences down the line. Let's put a political and ethical intent into our communication and our actions - our childrens' future needs every bit of leg up we can possibly add. WHY oh why encourage MS to take -away- reasons that people should not use Windows!?! Insanity. Zenaan ---------- Forwarded message ---------- From: "PFIR (People For Internet Responsibility) Announcement List" <pfir(a)pfir.org> Date: Mon, 7 Dec 2015 09:27:48 -0800 Subject: [ PFIR ] MS is ramping up their criminal Windows 10 upgrade scheme To: pfir-list(a)pfir.org MS is ramping up their criminal Windows 10 upgrade scheme Microsoft sets stage for massive Windows 10 upgrade strategy http://www.computerworld.com/article/3012278/microsoft-windows/microsoft-se… In an interview Friday, Mayfield said that the Windows 10 upgrade setting switcheroo on Windows 7 and 8.1 PCs was apparently due to continued updates that Microsoft has shoved onto the older devices. The Redmond, Wash. company has repeatedly re-served its original GWX app to PCs, often with undocumented changes, even if the machine already had the app, or even if the user had managed to uninstall it previously. "Microsoft has released this update several times," said Mayfield. "It doesn't change the name of the update, but every version is new, with new binary files." - - - Where the hell is the FTC when we need them? This is the sort of crap they need to be stopping. Windows 10 in its default settings -- not all of which are even straightforward to change -- is a privacy nightmare. On many older computers, its performance is slow and horrific. In many cases, older devices cease working due to lack of new drivers. What Microsoft is doing here is the equivalent of black hat hacking of user computers on an enormous scale. It's criminal. Especially if you're on an older computer, every time MS tries to get you to install Windows 10, say no, and strongly consider moving to a different system entirely, until MS' current leadership is in federal prison where they belong for computer crimes on a massive scale. --Lauren-- Lauren Weinstein (lauren(a)vortex.com) http://www.vortex.com/lauren Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com I have consulted to Google, but I am not currently doing so. My opinions expressed here are mine alone. _______________________________________________ pfir mailing list http://lists.pfir.org/mailman/listinfo/pfir

1 0

ANN: TCP injection attack detection tool - honeybadger
by David Stainton 07 Dec '15

07 Dec '15

Dear Golang community, Edward Snowden, cypherpunks, Tor-relay operators, low-level network hackers and TCP abolitionists, I was inspired by the Snowden documents to write a TCP injection attack detection tool. Powerful entities world wide are stock piling zero-days. TCP injection attacks can be used to deliver many of these attacks. source: https://github.com/david415/HoneyBadger docs: https://honeybadger.readthedocs.org/en/latest/ tasty pcap for "integration testing": https://github.com/david415/honeybadger-pcap-files HoneyBadger does bidirectional TCP stream reassembly... temporarily storing segments in ring buffer for comparison to later received overlapping stream segments. In other words it doesn't rely on simply matching duplicate sequence numbers but compares the actual overlapping stream segment contents. This more thorough approach is needed to account for TCP's retransmission which can send various segments sizes that can differ from the original dropped segment length. Furthermore we also detect the other injection types such as handshake hijack. The literature (go ahead and scour the Internet) does NOT mention all of the TCP injection attacks that are possible. I assert that there are 5 possible types of TCP injection attack. I describe them here: https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-to-de… current honeybadger project status: - honeybadger seems mostly useable for use in the wild, though we are pretty sure that bugs exist and probably some false positive bugs at that. - active development halted several months ago when the implementation seemed good enough to deploy and sniff packets in the wild. - if in the future the gopacket dev team releases a new "sufficient" TCP reassembly API then I could severely reduce HoneyBadger's code size. - pull requests and github issue comments will inspire me to contribute feature additions and fixes It runs on Linux but does honeybadger work on *BSD? Of course it does... I wrote the gopacket BSD BPF sniffer API ;-p and tested honeybadger on NetBSD, FreeBSD and OpenBSD. I'd like to explore the possibility of writing a similar TCP injection attack detector in rust using libpnet as soon as libpnet is sufficiently mature to use for TCP analysis: https://github.com/libpnet/libpnet So what? 1. So... all TCP analyzers need to be rewritten to account for TCP injection attacks, otherwise you are doing it wrong. 2. So feel free to use HoneyBadger to analyze your own traffic over the wire or sketchy pcap files that you acquire; perhaps our data collection efforts will result in responsible disclosure of 0-days... and publicly reporting that in fact these TCP injection attacks do happen as targeted attacks against real people to violate their human rights. 3. So use my design in your software; The description of how to detect the 5 possible TCP injection attacks can serve as a part of a design document for other software projects to implement their own TCP injection attack detection. cheers from the Internet, David Stainton

1 0

Encrypted email search indexing
by Silicon Dragon 07 Dec '15

07 Dec '15

*"Various hurdles are preventing wide-spread adoption of PGP encrypted communication, with easy searchability being one of them. I propose a standard allowing users to search through encrypted email safely. The search is tailored for text messages containing distinct words. Searching is achieved through a search index in plain-text attached to each email. The index contains each of the unique words contained in a message, salt hashed. There will be 10-50 salts per email account used randomly on a per word basis. Larger amount of salts mean more safety and more expensive search. Incoming messages will also get appended with a search index using IMAP APPEND command. ..."* https://ipfs.io/ipfs/QmVntBs8AxmeuLacGappM5LhB8ao9k2RPijvByESt4HmgC

4 3

Movie about aaron swartz can use some funding on kickstarter
by Cari Machet 07 Dec '15

07 Dec '15

I am not affiliated in any way - seems like a nice project Heres aarons moms tweet Only 3 days left to fund Kickstarter for "From DeadDrop to SecureDrop" https://t.co/ez7TA06XyV Link to Trailer: https://t.co/py6W00LmWs

2 2