- cypherpunks - lists.cpunks.org

TPP has provision banning requirements to transfer or access source code
by Zenaan Harkness 10 Nov '15

10 Nov '15

http://lwn.net/Articles/663817/ " Knowledge Ecology International looks at Article 14.17 of the Trans-Pacific Partnership (TPP), which has a provision banning requirements to transfer or provide access to software source code. "I'm wondering how the GPL fares here, and how much money Microsoft spent lobbying to get this included in the TPP, or if the NSA has a role in this. One aspect of this provision is that governments cannot insist on source code transparency, for mass market software, even to address concerns over security or interoperability."

2 1

Re: [FORGED] Re: [FORGED] Re: UK To Ban Crypto In Devices, Email And More
by oshwm 09 Nov '15

09 Nov '15

On 09/11/15 08:38, Neuhaus Stephan (neut) wrote: > On 2015-11-08 09:45, "cypherpunks on behalf of oshwm" > <cypherpunks-bounces(a)cpunks.org on behalf of oshwm(a)openmailbox.org> wrote: > >> >> >> On 08/11/15 08:40, Peter Gutmann wrote: >>> oshwm <oshwm(a)openmailbox.org> writes: >>> >>>> Can GPG be easier to use, I think so, is it too difficult to use by >>>> ordinary >>>> people - no, they're just too fucking lazy and lack motivation. >>> >>> ... and this is pretty much the poster child for why we have so much >>> unusable >>> crypto today. >>> >> >> Or, why we have such a fucking retarded human race with the attention >> span of a knat who expect everything to be given to them on a plate. > > I think you're rather making Peter's point for him. > > Case in point: Would you care to try to explain to my dad (who is 76) what > an expired PGP key means, exactly? What a trusted key is? Hell, what a > public key is, even? How a PGP plaintext signature could have failed to > verify? (In this context, don't forget to explain to him the difference > between UTF-8 and ISO 8859-1.) Hint: an attitude of "well, you just have > to learn all these new concepts, you fucking retarded human with the > attention span of a knat" is probably not going to help. > I feel sorry for your dad, having a child that thinks so little of his mental capacity. If your dad can operate Windows and an email client then he has what is needed to learn enough to sign and encrypt emails with GnuPG. He doesn't need to know how crypto works or every minute detail, he just needs to be able to make sense of a Wizard and to be able to click a few buttons. He'll be at a disadvantage for not learning more about crypto and PGP but he'll be able to maintain a small amount of privacy in his use of email. When he gets stuck he might be able to ask his son or daughter for help - assuming he hasn't given up asking because you hold his mental capacity in such low regard. > If we want "ordinary people” (whatever they are, but in a crypto context > they’ll be more like my dad than like me) to use encryption, we will have > to make it invisible to them. It doesn't even have to be perfect; good > enough will do. > You think if crypto is invisible to people then they'll be able to deal with when things go wrong any better than your dad would be if you equipped him with minimal knowledge of how to get by with PGP using e.g Enigmail on Thunderbird? The more you hide details from people, the less they are able to help themselves. > Fun, > > Stephan > — > > If I have downvote policy, I will downvote you. I'll take that as a compliment, thank you :) > >

2 2

Fwd: [cryptography] Introducing myself
by grarpamp 09 Nov '15

09 Nov '15

---------- Forwarded message ---------- From: <stenski(a)nymphet.paranoici.org> Date: Sun, Nov 8, 2015 at 8:06 PM Subject: [cryptography] Introducing myself To: cryptography(a)randombit.net -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My true name is the OpenPGP key whose public component is appended below. "Igor Stenski" is just a nickname. Each message from me is signed with this key. Interests include o zerocash [1]; and o bonded identity (a variant of fidelity bond [2]). bitcoin: 1JvAjr6DFg673Qy82n8WbWfdSYGmSZy1Jw [1] http://zerocash-project.org/ [2] http://en.bitcoin.it/wiki/Fidelity_bonds - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.12 (GNU/Linux) mQINBFYW2V0BEADVyNsPcBBHoM0ejwCDvF5KSCuc8ufCEemMhrIKQAhdu/QPMEEs b5xu/3r2C7rUOAxSlZLGWdgkQ2jA/XCjve4po3p+t1Gi1kNJB8n82XBnBy0qQVKP kacyl5JuUF76ihM1+UMD6Puq85/24fBD1OD/4T0HqOXAHVwU2ddiopDSNhD7te6l MeUJj2HFx882Y4756hRO6CzXpQI4+wiN2ehdZEMQo6gF1b9ccO0XAuu10isvoyu3 Ux3wIfDjJNbySAQdu8Z5QHKEdHaTkEQRPiKHsl5B8w2NB3EYPCwr/r1r78BxjH6m Rbju278dB+6lOc8sfyyOhVLuCtvBMl6Kih2D4wnuboB+bWI/jHfVgsq2mPakrGEc DVLOlYptAZlQOrTDDAd4pODZHHC/Iawr4y/8f9GUESHOTEuKxI0+xXNNxpabjGCd /mf08U+aGFYHVxhYNZFX06uhADfDz4zRyFlJcHrmeOIOIvOpC6P2MKgMXj7DYXfu VxPaBQrhu5XUPjyccvYDC0fsV+wHcTCdGa2c+6CLCkLUznQm4P+ShTaPrh0q2Ujs Y7wsxgeV018A76ndCFMbwKM806WMXgFJGyZsIMu2MhI/QmkTzqurH+ux+vdYKNRN 2bMO9GgXdcqUsHF5tWfYpHaRuSugmMO7yBDbaaiKD/mS1gJZThjADGgzzQARAQAB tCxJZ29yIFN0ZW5za2kgPHN0ZW5za2lAbnltcGhldC5wYXJhbm9pY2kub3JnPokC OAQTAQIAIgUCVhbZXQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQVmjw A0F6imhVuQ/+OyBm8mPhDabJTmK+OBcVsH3vOO5dAB93QUaOdJEexv2GVl3rtKCP kix+ptyqQmmnYU9HQViRhVr+8kkyEjJhV4wZVrHlHa45st0jPOGqtCZTO6gjuSiD ZNK7YkUcxppDqYBZtocD5xIX/rn3e7Q6g0KhS0CP56rVBbf2iNetMQrBrxe3TigX UA1n0pA0LRM1d0Ekt3U01+Zr0lW8pz4Cdvo/MV5ZJ1w2NwezUs/fU8aIMBp3eGXu PVA7dqbmJhxv+D1HVSxn6gBPZpEefgOctpKGVmnEpoOTPOCJOcBY1Lb2zehHO3z7 4J1M9NlOQa1CyrmkfcanVxn38elRcLD8m6muBMZ+R8sSqY64mu7QVp0mwZ2wiZal 0kfy5Cgs8lsQ4hPbPAXas1wqGrA1DZ3c9JpJ7wXVCfQqlL4taVSNXucSutxN3VBA SfDpV4fwgQLqGBchPoy9+B8PCyy/XCEzlBMBUiUurFQX6XWNgWXz+h0P49tpegaZ q9hZLxlLHT8Gcu6ShYYI/FtoPLpd6vHktqmc8ckzDrlxl/aGq33fsTfkuZCZT5Ch FVFh/ojymgSjmkkzDb65C2LycIkhGh+mfLfefhW1i58Cp2vvNzoBojyeZivkfBn/ OkahsYisOeoH+/GKN3MAt4o4qPOfqGd9s3MA+v8+sAPaGs//6GqjkQC5Ag0EVhbZ XQEQALYkngci9UgDa17n0ZvdBrXlFBwETpL8k7YbeCH2a3fzyTAALCzIPOqx1pEB c5FxTsw8LhG1I7xSiQn/M+litM+Q6G/diEuGQeECUSwkjECkUMg0rjtQa9m+3N6x FCmk+JL+VPyB/9p/g0sS2iacbNi+ckFAK/jATRP1DzxXHalpw3PzsBe1mkjjiFeK Xbcsv9wtCmS4PfqZFOvhjo9ArcCzYUBW77f9iBOJ5LjUVRuwyywT8y3vbRA3eH4q /SCvz+nSZgY4+1Raw2vUUvWAfcpDEUmKIIP6ymagivM1jFGTeFu58xm0UB0ajsIR TKBI8nBeDMzW/HlMKEtQi3iExuuUUkq/8FnG/oVS/yJukouO+2CKjkQLdZlSM3/j TpgR6Ca1KZMmYuWa2Z9/7dMhM6u3/BAytrFOTCiKsHwwVQ2guuIivZx3EJ0bXQZY bnzeFsW2DXupvVcgEc3fhVdnuxVj0ia01dpkGjFq1/iCfq/Y+DNw9aAsEmSDkGGT qUeOYLYeeElzXRM2zryI6EKy6E9JQWp3mRLBOE2bywJwlJQN+5pMLSb3PSE5WWee ynhW/IJmYSmZmq3AMbnZcE2DYmAZdk91Ob0vu5vvZ4MBGmXD9ypFaiR47lgFzBhA 1/Ej8X3+77/OvCAk0pCBF0HOLHEZRpTcKFzD9ZH78ShZ2EpjABEBAAGJAh8EGAEC AAkFAlYW2V0CGwwACgkQVmjwA0F6imhnGQ//d99nxo20lY0vG4ALlefVS9g2Q88p qyUqMtZj3Q9gQoWWeh/37xIzpKcO3DsJFtSiuv13F0N7RbbEpcPkclILLX0Ai1+v h9L4sV+39ipiLf6JNnNkswkAw8wuED5zXoDF6k6e5LDdZRNSKjv3hXbDOzN35M7p fbJMxrzm4tksQGkibTtrrzSVLPWp+ATRcYTeO5m7wAikf/1/vRcc/vAT4mKaitIr CgTfbgoVff9zL61dWiH5EUyJRkRqAj5FX8rrQ+Yb8ZeDfXw/tt+FgpzfM6w38xuc +oL0hgCBE9IXvuwcRbu+W4m130mJhdcJCu7/ibuqFFazE+LDXhSpS5Sjg2bo1W8l RwpfG38q0DXBXwde6AEBWeIGhUVWO+iZahCeU5b1lmmFC3lJ+/yT12lK8JTDuG2o usyz9tQxmLvx6NJrYnIU6AR7Kmjtbot+oUDODRmgUfKajgEy4wPEANmwfGEgQjAw TpDG+rfBn3dZ5efRU20t61Q5/Xr5fiDdGnqVei/2Gq5qSGbx/20hzcoOS82E/jyL g7SYKX6cdwqdeguzGdJYlp2TCwCgGZC2msEBCcwwSjuUs9Qt3bUnFhlSp0knoTmZ amkT8Q/pMfdj+0M2+4ER9kDbwRNfSHJSeg2+Sk8buCdmucKBY1WeXdEiY+EqrRBD 7u5Pm9GH/BR7FIQ= =KgoN - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Processed by Mailcrypt 3.5.9 <http://mailcrypt.sourceforge.net/> iQIcBAEBAgAGBQJWP87hAAoJEFZo8ANBeopo9dAQAKlCJepH4yr/OYKI1Gz2iX0o gSBZeAp7itUBCTWgU2f34kXGkLkv+LtWGJml/U1ud3H33XqZBnWwOAwE6/Z4Z22u 8Hk/+q0jmuPJHQv8Rz1w9kP7O9p6pwWm+X5j3Gvj5Vd7F6w8lMINojpwFiapWdP/ nnuTWylr/BOmgIu3toloyVrPzGWU/2ApiNECVskU0h/SfyhDJP6tHkhtpyH/l3YH wJEMGO9DUZkE6WovmWqxk20PbHGXLKjYjGy/bDh5nqYfByoVk/7TfnUmUmRVBce7 bKYBaJLpDHNU99HL71xv6snAOmytNbL7a1c/TVvl0lgsBiThqIOLZyaTS0VER2+W Gse8hd8hBp6q/9VCeee49QGC0T6CXUxAOv1g9IUT4F+s1DXds1wuNReCJdXhLtag 1d2nZRc3fhqc/jXbUCwLYp3k0WvDYS0OCVqxXLxE1OKpuZPMlaOzrPdy5qE8tsCb qWm6Si3fnx6om3Q/BA0QFcnvw8MB/rwF7/Vs2YYY+iiJquNc6IxEfeNqjv/fwgCc XTrUHW1R29PN6k7eHDpFw8BkDX6OoD83hGUVpgSYyjR6vFGN95J98pDnzJZ0EvsL GNzO/b9CmwD1mcSjFYp26/3pDNXDftMpVwf9IPnKwdr3xhoYzhw0g7ZeUiVYGYvp eHSdvPIZuJJGqHHcxfxo =gzUD -----END PGP SIGNATURE----- _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

3 2

Re: Suggest High-Signal Crew Ditch This for Reddit
by dan＠geer.org 09 Nov '15

09 Nov '15

http://news.yahoo.com/nastiness-threatens-online-reader-comments-053929979.… the gist: we need algorithms to prevent free speech we don't like and until we have them we're turning off/down comments freedom, safety, comfort -- choose two... --dan

4 3

Re: FOIPA adventures
by Ryan Carboni 09 Nov '15

09 Nov '15

http://www.dni.gov/files/documents/FOIA/DF-2015-00270.pdf You're famous!

2 1

‘I’m comfortable with my choices’: Snowden on CIA torture, ISIS and surveillance
by Zenaan Harkness 09 Nov '15

09 Nov '15

https://www.rt.com/news/321105-snowden-swedish-media-interview/ http://fokus.dn.se/edward-snowden-english/

3 3

a possible insight into motivating totalitarianism
by Zenaan Harkness 08 Nov '15

08 Nov '15

Not to be confused with "failure to exercise public duty of care and hiding of known contraindicating data." Z --- http://www.frontpagemag.com/point/260713/new-yorks-radical-left-wing-attorn… New York's Radical Left-Wing Attorney General Plots to Criminalize Opposing the Left November 8, 2015 Daniel Greenfield Here's a little reminder for anyone who doesn't believe that what the left really wants is a totalitarian state in which opposition to its agenda is a crime. New York's Attorney General Eric Schneiderman is extreme even by left-wing standards. He's a radical who ran by promising that violent racist thug Al Sharpton would have an "annex" in Albany if he won. Now Schneiderman and a few left-wing congressmembers have come up with a great idea. Charge Exxon with securities fraud for not "disclosing" the risks of Global Warming. Whether on not any charges happen, this is a foot in the door for an agenda list that goes well beyond Global Warming. After energy companies that aren't paying protection money to Al Gore, gun manufacturers can be hit with charges for not "disclosing the risks" of gun violence. Private prisons can be hit for not disclosing the risks of failing to back sentencing reforms. Educational companies can be hit with charges for not disclosing the risks of not adopting Common Core. Basically any company that disagrees with a left-wing policy can be hit with civil and criminal charges. It helps if the company, like Exxon, at one point employed kooks who claimed the sky was falling. But that just makes the case easier. If the executives disagree with a left-wing policy, it's securities fraud. Under this standard, it becomes child's play to cut off conservative organization from any corporate funding. Furthermore, conservative organizations would be muzzled by extension. Funding organizations and people that dissent from the left would be "fraud". Because that is what this is really about. Global Warming is the testbed for making leftist ideology mandatory. Manufacture a fake consensus, then use the law to make it mandatory. Then there can be a pseudo-scientific consensus on a variety of issues, such as the need for higher taxes, and a crackdown on anyone who disagrees. Since there's money in pursuing charges like this, and since the best way to get the left off your back is to give their political allies money, this is robbery for tyranny. And that's how the left does business. This is where the left has always been headed. This is a totalitarian movement

1 0

Fwd: Re: [FORGED] Re: [FORGED] Re: UK To Ban Crypto In Devices, Email And More
by John Young 08 Nov '15

08 Nov '15

Analogy of learning to drive to learning crypto is pretty good privacy. Extend that from needing a key, fob or fingerprint to start a vehicle to needing a computer and a device, token, card, fingerprint, to encrypt. Plug it in, encrypt begins, nothing else needed except driver license, intelligence, vision, hearing, gasoline or battery, safe roads, directional signs, fuel stations, cops, insurance, anti-theft devices, annual inspection, license renewal, or when disabled, poor or broke, terrified of mass killing excessive vehicles, alternate means of encryption, like buses, trains, aircraft, ships, taxis, limos, choppers, subways, balloons, horses, feet and sidewalks while packing a gun, knife or pepper spray for defense against predators, rapists, thieves, rubber hoses, hackers, crackers, dopeheads. But maybe a profession of encryption officers to encrypt for the user, like lawyers, doctors, engineers and notaries, state licensed for protection of customers, self-regulated because nobody would know crypto like the pros, with a crypto system like the justice and prison systems to assure accountability and punishment for infraction. Would require outlawing crypto use by anyone except a pro and official secretkeepers but, cereal box DIY would be available. PKC would be banned as a state, church and family offense, like kiddie porn and WMD. Cryptographers would be venerated as high holies, sack clothed, wild haired, slit-eyed, filthy, babbling, narcissitic jerks, abusively sado-masochistic, panhandling, duplicitous, feared, contemptuous of ordinary humans, ostracized, distrusted. Woe peddling obsessives. Hmm, that last is the current faith in encryption religion. Could be left as it is, isolated, ignored, ridiculed, tatooed with a Red C on forehead. >Authentication-Results: antiproton.jfet.org; dkim=fail > reason="verification failed; unprotected key" > header.d=openmailbox.org header.i=(a)openmailbox.org > header.b=ou82dX8n; dkim-adsp=fail (unprotected policy); > dkim-atps=neutral >DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=openmailbox.org; > s=openmailbox; t=1446972344; > bh=ud2Izg/X/db1uEkNBQ6hGyKf00WWSWeic6lcOI+ZFYw=; > h=Date:From:To:Subject:References:In-Reply-To:From; > b=ou82dX8nMcSlR0Qcf2A0v8cdjNhgy4MyMdlTxr3R6KFrimuR9JLlLnTwA/i7wNndG > Sj0ixiyPZ4Y1qANRthloNl6bOW16BQ7J2JnP/fvCsbs9mR72nriONDVYjsYPQZEWGB > PzTLd7eqmqR68F8116KM88n8sBqMtMCewMtBBEX0= >X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on openmailbox-b1 >X-Spam-Level: >X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, > DKIM_VALID,DKIM_VALID_AU,NO_RECEIVED,NO_RELAYS autolearn=no > autolearn_force=no version=3.4.0 >DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=openmailbox.org; > s=openmailbox; t=1446972343; > bh=ud2Izg/X/db1uEkNBQ6hGyKf00WWSWeic6lcOI+ZFYw=; > h=Date:From:To:Subject:References:In-Reply-To:From; > b=uD4HCz9MH+3yecaOQpQIHs5KPiYB6pe6yGyo27V9HyLNa3090cgCHw1a6/BDCIixO > EocHa232/mmc4s5Yf0jD3ybSnLPduXucbmQ+mNk7xt5LD+jVTyKEzBAcx5gKtP8Ihf > mW89SQVktK6O7Cp2ozbRJW945rs+DUFU9jnqosmM= >Date: Sun, 08 Nov 2015 08:45:43 +0000 >From: oshwm <oshwm(a)openmailbox.org> >User-Agent: Mozilla/5.0 (X11; Linux x86_64; > rv:31.0) Gecko/20100101 Icedove/31.8.0 >To: Peter Gutmann <pgut001(a)cs.auckland.ac.nz>, > "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> >Subject: Re: [FORGED] Re: [FORGED] Re: UK To Ban Crypto In Devices, Email > And More >X-BeenThere: cypherpunks(a)cpunks.org >X-Mailman-Version: 2.1.18 >List-Id: The Cypherpunks Mailing List <cypherpunks.cpunks.org> >List-Unsubscribe: <https://cpunks.org/mailman/options/cypherpunks>, > <mailto:cypherpunks-request@cpunks.org?subject=unsubscribe> >List-Archive: <http://cpunks.org/pipermail/cypherpunks/> >List-Post: <mailto:cypherpunks@cpunks.org> >List-Help: <mailto:cypherpunks-request@cpunks.org?subject=help> >List-Subscribe: <https://cpunks.org/mailman/listinfo/cypherpunks>, > <mailto:cypherpunks-request@cpunks.org?subject=subscribe> >Sender: "cypherpunks" <cypherpunks-bounces(a)cpunks.org> >X-ELNK-Received-Info: spv=0; >X-Authentication-Results: dkim="fail"; (1:no or failed dkim >processing); dmarc="none"; (1); dwl="miss"; den="not exempt" >X-ELNK-AV: 0 >X-ELNK-Info: sbv=0; sbrc=.0; sbf=bb; sbw=000; >X-Brightmail-Tracker: AAAAAA== >X-Brightmail-Tracker: AAAAAA== > > > >On 08/11/15 08:40, Peter Gutmann wrote: > > oshwm <oshwm(a)openmailbox.org> writes: > > > >> Can GPG be easier to use, I think so, is it too difficult to use > by ordinary > >> people - no, they're just too fucking lazy and lack motivation. > > > > ... and this is pretty much the poster child for why we have so > much unusable > > crypto today. > > > >Or, why we have such a fucking retarded human race with the attention >span of a knat who expect everything to be given to them on a plate. >People have to stop being lazy and start taking an interest and >responsibility for what goes on in the world around them - your point of >view re-inforces the dumbing down of the population and the increase in >power of the Government and big Corps. > > > Peter. > > > >

1 0

Protonmail releases details of dDos attack
by Razer 07 Nov '15

07 Nov '15

They paid ransom to 'criminals' and it didn't stop. I stand by my earlier statement UK government's GCHQ/allied nation's intel agencies are responsible, and will never be held accountable under their own laws. Anyone know bitcoin address 1FxHcZzW3z9NRSUnQ9Pcp58ddYaSuN1T2y? Interpol want to speak with them... RR ----------------------------- ProtonMail Statement about the DDOS Attack As many of you know, ProtonMail came under sustained DDOS attack starting on November 3rd, 2015. At the current moment, we are not under attack and have been able to restore services, but we may come under attack again. We are currently working with solution providers to find a way to mitigate this attack, however, it is quite unprecedented in size and scope so unfortunately finding a working solution is not easy. Because of the sophistication of this attack, we will also need to resort to quite expensive solutions which will burden our finances. It is for this reason that we are also collecting donations for a ProtonMail defense fund. ProtonMail was originally created to provide privacy to activists, journalists, whistleblowers, and other at risk groups, and we have many of those people in the ProtonMail community. Unfortunately, there are groups out there determined to oppose this which has led to this incident. However, we are confident that with your support, we can overcome this attack and come back stronger than ever, and continue to provide a place where online privacy is protected. As we will detail below, this attack has grown beyond just ProtonMail and is a full fledged cyberattack. We have been working with the Swiss Governmental Computer Emergency Response Team (GovCERT), the Cybercrime Coordination Unit Switzerland (CYCO), as part of an ongoing criminal investigation being conducted here in Switzerland and with the assistance of Europol. After much consultation, we have decided to release details about the full extent of the attack on us so the broader security and privacy community can stay informed. Slightly before midnight on November 3rd, 2015, we received a blackmail email from a group of criminals who have been responsible for a string of DDOS attacks which have happened across Switzerland in the past few weeks. This threat was followed by a DDOS attack which took us offline for approximately 15 minutes. We did not receive the next attack until approximately 11AM the next morning. At this point, our datacenter and their upstream provider began to take steps to mitigate the attack. However, within the span of a few hours, the attacks began to take on an unprecedented level of sophistication. At around 2PM, the attackers began directly attacking the infrastructure of our upstream providers and the datacenter itself. The coordinated assault on our ISP exceeded 100Gbps and attacked not only the datacenter, but also routers in Zurich, Frankfurt, and other locations where our ISP has nodes. This coordinated assault on key infrastructure eventually managed to bring down both the datacenter and the ISP, which impacted hundreds of other companies, not just ProtonMail. At this point, we were placed under a lot of pressure by third parties to just pay the ransom, which we grudgingly agreed to do at 3:30PM Geneva time to the bitcoin address 1FxHcZzW3z9NRSUnQ9Pcp58ddYaSuN1T2y. This was a collective decision taken by all impacted companies, and while we disagree with it, we nevertheless respected it taking into the consideration the hundreds of thousands of Swiss Francs in damages suffered by other companies caught up in the attack against us. We hoped that by paying, we could spare the other companies impacted by the attack against us, but the attacks continued nevertheless. This was clearly a wrong decision so let us be clear to all future attackers – ProtonMail will NEVER pay another ransom. Through MELANI (a division of the Swiss federal government), we exchanged information with other companies who have also been attacked and made a few discoveries. First, the attack against ProtonMail can be divided into two stages. The first stage is the volumetric attack which was targeting just our IP addresses. The second stage is the more complex attack which targeted weak points in the infrastructure of our ISPs. This second phase has not been observed in any other recent attacks on Swiss companies and was technically much more sophisticated. This means that ProtonMail is likely under attack by two separate groups, with the second attackers exhibiting capabilities more commonly possessed by state-sponsored actors. It also shows that the second attackers were not afraid of causing massive collateral damage in order to get at us. At present, ProtonMail’s infrastructure is still vulnerable to attacks of this magnitude, but we have a comprehensive long term solution which is already being implemented. Protecting against a highly sophisticated attack like the second one which was launched against us requires sophisticated solutions as we also need to protect our datacenter and upstream providers. Cost estimates for these solutions are around $100,000 per year since there are few service providers able to fight off an attack of this size and sophistication. These solutions are expensive and take time to implement, but they will be necessary because it is clear that online privacy has powerful opponents. In order to cover these costs, we are collecting donations for a ProtonMail defense fund, which can be found here: We are fighting not just for privacy, but for the future of the internet. We would especially like to thank the thousands of users who offered their support and encouragement on Twitter and Facebook, we will never stop fighting for you. Over the next several weeks, we will begin putting in place the sophisticated protections that are necessary to withstand large scale attacks like this to ensure that online privacy can’t be taken down. https://protonmaildotcom.wordpress.com/2015/11/05/protonmail-statement-abou… ---------------------------------------------------

1 0

And now, for a moment of levity
by Michael Best 06 Nov '15

06 Nov '15

In lieu of the covert comic, some humor for a list that's often... contentious. Enjoy, if you dare venture to the Twit-light Zone. https://twitter.com/FreudCyber Choice quotes: - Cryptanalysis is, in essence, a cure through love and mathematics. - The hacker has a number of representations for the erection of the male genital that may be called symbolic, such as "privilege escalation". - Furthermore, to the male hacker, the female genital is represented by TCP ports, cryptographic tokens, and input buffers. - Bad security serves to arouse sexual inquisitiveness, which always strives to restore the sexual object by uncovering the hidden data. - The super-user retains the character of the father. The more powerful the Oedipus complex was, the more elevated its privileges will be. - A hacker's mental life can be described in terms of the id and the super-user. The super-user emerges when the id retreats, becomes zero.

1 0