- cypherpunks - lists.cpunks.org

Five Eyes Bent On Killing Crypto
by grarpamp 05 Jul '17

05 Jul '17

https://arstechnica.com/tech-policy/2017/06/australia-to-target-encrypted-m… https://www.theglobeandmail.com/news/politics/five-eyes-stress-sharing-info… https://www.eff.org/deeplinks/2017/06/five-eyes-unlimited This week, the political heads of the intelligence services of Canada, New Zealand, Australia, the United Kingdom, and the United States (the "Five Eyes" alliance) met in Ottawa. The Australian delegation entered the meeting saying publicly that they intended to "thwart the encryption of terrorist messaging." The final communiqué states more diplomatically that "Ministers and Attorneys General [...] noted that encryption can severely undermine public safety efforts by impeding lawful access to the content of communications during investigations into serious crimes, including terrorism. To address these issues, we committed to develop our engagement with communications and technology companies to explore shared solutions." What might their plan be? Is this yet another attempt to ban encryption? A combined effort to compel ISPs and Internet companies to weaken their secure products? At least one leader of a Five Eyes nation has been talking recently about increasing international engagement with technology companies — with a list of laws in her back pocket that are already capable of subverting encryption, and the entire basis of user trust in the Internet. Exporting Britain's Surveillance Regime Before she was elevated to the role of Prime Minister by the fallout from Brexit, Theresa May was the author of the UK's Investigatory Powers bill, which spelled out the UK's plans for mass surveillance in a post-Snowden world..........cont.....

4 5

Tails prevents MAC changes as design feature
by didukno 04 Jul '17

04 Jul '17

I have issues with network interfaces, like wlan0, changing back to what the system wants. This is not what I want. Case: - Start Tails (MAC Address Spoofing: On) - Plug in network card (wlan0) - macchanger assigns wlan0 random MAC string - Bring wlan0 down - Set new MAC string (macchanger or other tools) - Bring wlan0 up - macchanger changes new MAC string to Tails' NIC-only MAC string This did not happen in older versions and may very well be a bug. If not, what development decisions have gone into making this change and why are they better than me changing my MAC and having the system respect that? Why continue with the insecure model of changing NIC only? Willfully leaking network device manufacturer info is irresponsible. didukno

2 1

Bitcoin: South Korea Soon To Come Online
by grarpamp 04 Jul '17

04 Jul '17

https://www.cryptocoinsnews.com/south-korea-preparing-legalize-bitcoin/ http://www.koreaherald.com/view.php?ud=20170703000867 https://www.reddit.com/r/Bitcoin/comments/6kzmhp/south_korea_is_preparing_t… North Korea Soon To Go Offline https://www.cnbc.com/amp/2017/07/03/north-korea-launches-missile-nearing-ja…

2 1

Rojava: Reddit Overview
by grarpamp 04 Jul '17

04 Jul '17

https://www.reddit.com/r/rojava/top/?sort=top&t=all

1 0

Vulnerability of OpenSource Software download mechanisms: VLC
by Fabio Pietrosanti - Lists 03 Jul '17

03 Jul '17

Hello, as we move to improve the status of encryption of the internet and at all levels internet companies diffuse the uses of HTTPS encryption and integrity protection methods there are still a variety of massively diffused pieces of software that can be subject to malware injection trough MITM techniques. VLC, Videolan Client, the most used opensource video player have their entire website in HTTP, their download page in HTTP and the mirror providing the downloading in HTTP. However they are refusing to implement HTTPS arguing that because their .exe are digitally signed with authenticode they are safe https://trac.videolan.org/vlc/ticket/18472 . Please help me explain them how digital attacks works, or please someone make a MITM video-screencast to show them how urgent and important is to upgrade all of the connections to HTTPS. -- Fabio Pietrosanti (naif) HERMES - Center for Transparency and Digital Human Rights http://logioshermes.org - https://globaleaks.org - https://tor2web.org - https://ahmia.fi

5 4

Re: [Cryptography] actual journalism, was LRB article, Satoshi's Trump Card
by James A. Donald 03 Jul '17

03 Jul '17

On 03/07/2017 4:31 PM, Ben Laurie wrote: > Confused by this - Merkle trees inherently don't grow to enormous depth. The bitcoin hash chain grows to enormous depth, and arguably it is a Merkle tree that testifies to all transactions everywhere that ever taken place in bitcoin. If you say it is not a Merkle tree, then fine. A scalable crypto currency has to employ a Merkle trees instead of whatever we call the thing that Bitcoin uses.

1 1

GPG: Deprecated hash + local "game over" exploit
by Steve Kinney 03 Jul '17

03 Jul '17

Greetings, A couple of days ago Shawn pointed out offlist that my GPG installation was using SHA1 when signing messages. Although seven hash functions are included in GnuPG 1.4.16, SHA1 is still the default. For most purposes this is no cause for panic, but it's "untidy" at best and might occasionally bite someone in the ass. The simple cure is to append this to gpg.conf: personal-digest-preferences SHA256 SHA512 digest-algo SHA256 I wonder when the gpg guise will get around to updating the default hash... On a related note, gnupg-agent stores typed pass phrases for 10 minutes, as a convenience when reading or signing multiple files or documents. Only one little thing: It stores typed pass phrases until the machine is powered off, regardless of configuration settings per the gnupg-agent man page. Last time I checked, this bug was dismissed by Debian as a non-issue, saying that exploiting it would require physical access to the machine and "physical access is game over." That's an excuse to leave the bug in place, not a reason. I am sure present company can provide several examples of cases where the presence of gnupg-agent in its present broken condition "is game over" for the user. Four years ago I noticed this problem, exhausted "sane" remedies, and found an effective work-around that denies gnupg-agent access to pass phrases when using Enigmail or GPG itself. http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o)

3 4

Rojava: YPG SDF Blasting ISIL's Fabled City of Raqqa FTW
by grarpamp 03 Jul '17

03 Jul '17

https://twitter.com/AzadiRojava https://twitter.com/Gargaristan/status/880133821664022528 https://twitter.com/KufriusMaximus http://www.ypgrojava.org/In-Pictures:-Recent-days-of-the-great-battle-for-R… In Pictures: Recent days of the great battle for Raqqa liberation

2 1

Re: [Cryptography] actual journalism, was LRB article, Satoshi's Trump Card
by grarpamp 03 Jul '17

03 Jul '17

On Sun, Jul 2, 2017 at 5:37 PM, John Levine <johnl(a)iecc.com> wrote: >>Then maybe some combination of them could earn some crypto coin. > > Having looked at the articles the author wrote before and after the > pair he wrote last year on the Craig Wright affair Didn't notice a pair, unless this video makes the first of them. https://www.lrb.co.uk/2016/06/28/andrew-ohagan/on-craig-wright-and-satoshi-… https://www.youtube.com/watch?v=zxMU4C6bGKw > I think I can say > with fair assurance that [authors have] better things to do than to screw > around with cyber funny money. Sounds like there's a market for concierge services that will collect this cyber funny money and convert it to deliverable fiat under contract. > real money There's that word again. Last time it came up no one seemed able or brave enough to risk defining and defending in context with cryptocurrencies, beyond say, "paying taxes with it". > Speaking of actual journalism, online magazine Slate has a weekly > Slate Money podcast which is quite good because host Felix Salmon when > he's not making dorky jokes has an excellent grasp of finance and > economics. Last week's edition had an interesting segment on Initial > Coin Offerings. It starts at about 31:14 in the podcast. > > http://www.slate.com/articles/podcasts/slate_money/2017/06/uber_amazon_buyi… > > They conclude (I think correctly) that most ICOs are scams even if > their proponents don't think they are Yes they're "scams" in that hardly any of the more than hundreds of effectively cloned coins out there are bringing any substantial new developments or combinations of capabilities that will cause them to float to a top ten position long term. Notwithstanding, it's an open market full of niches and this process is vital to developing the space. Developing scaling, privacy / anonymity, integration with things and economies are very large potential areas. These are early days. > they note that for most > alt-coins the only practical way to buy them is to use bitcoin as an > intermediary. Some areas will lead / lag at times, the market matrix is no exception. There was no way to buy BTC (₿), and you probably can't readily buy KPW (₩) yet either. If certain forces get their way, you won't be able to buy either ever again, maybe not even beloved USD ($)...

2 1

Re: [Cryptography] Satoshi's Trump Card
by grarpamp 02 Jul '17

02 Jul '17

On Sun, Jul 2, 2017 at 3:01 PM, Ray Dillinger <bear(a)sonic.net> wrote: > What puzzles me about these discussions is that people assume, with no > evidence and apparently for no reason, that Satoshi would choose to play > his (or her, or their) so-called "Trump Card" in some way that agrees > with their own particular agenda. A general theme is that large holders (or whoever might have stolen or other access to stashes) can influence outcomes. It's *not* meant to insinue or comment on "Satoshi" proper, but to highlight possible X factors present in various coinbases. Founders archives, rich lists, combined with how a coin can be used or influenced, can all be places to look for them. Emergence of DC's themselves is steeped in crypto "anarchism possible" activism. Participants (minimally investors) in any cryptocurrency would be nuts to not consider them if present. 1M BTC plus rich list are a present and non-negligible factor. ex: Corporate SEC prospectus filings routinely cover risks. > The Satoshi I remember would be > evaluating the alternatives pretty much objectively, and relating them > to the current problems rather than the problems faced by the original > design. And might choose either, based on its merits. Or might choose to develop and propose other new technical solutions from time to time. Or play cards, even counter to presumed agenda, for fun. Any rebirth will be interesting. Yes many are quite objective solution finders, evaluators, and choosers. > They are considering the incentives of the users, when in fact the fate > of a block chain is determined by the incentives of the miners. No. Blockchains are multi-variable, all variables and parties affect the others. Users control miners just as much as miners control users, as do relays, as do markets, etc. All must cooperate at least somewhat if any are to survive, and complete loss of any one will kill. > The fact that the interests of miners and users are not necessarily > aligned, I have always regarded as one of Bitcoin's flaws. Comparative designs - that encourage / permit / require / result in, say, competitive exploitation (optimization?) of the other variables... vs - that somehow proffer result in a naturally harmonious / immune to <whatever "evil"> seeking / mutually upwardly beneficial / aligned and happy... Yes would be interesting.

1 0