- cypherpunks - lists.cpunks.org

Re: [Cryptography] Does anyone here know PAM?
by grarpamp 05 Apr '17

05 Apr '17

On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > This is a call for technical assistance with a crypto project. Hopefully it > will be of wider benefit if successful. > > The Mathematical Mesh has the goal of making computers easier to use by You mean http://www.prismproof.org/ > making them more secure. Note the order. While there are some times that it > is appropriate for a cryptographic key to require the user to enter a PIN or > the like to use it, that cannot be the default requirement, nor is it > acceptable to just leave private keys sitting on disk unencrypted. > > Windows and OSX both provide features that cause private keys and other > credentials to be unlocked automatically using the user's password as a PIN. > I want to achieve the same on Ubuntu. I am happy if the solution can also be > carried across to other Linux and FreeBSD but don't have resources to cover > anything else. Various tools / ports / projects in both Linux and BSD do exist that will get you magical login encrypted homedirs. OSX also has it. Now that per dataset crypto keying is in ZFS, you might expect to see some uniform use of it spread across everything except Windows. http://open-zfs.org/wiki/ZFS-Native_Encryption https://youtu.be/frnLiXclAMo https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=shari… http://pefs.io/ https://github.com/glk/pefs https://wiki.freebsd.org/PEFS http://glebkurtsou.blogspot.com/search/label/pefs You could find other implementations, FUSE, PAM, login, etc here... https://www.freebsd.org/ports/categories-grouped.html Linux does bunch of things with FUSE / PAM / dmcrypt. Even the old NFS crypto loopback still exists. > The authentication mechanism is PAM. So far, the only documentation I have > found has been of the barely more comprehensible than the code variety. https://en.wikipedia.org/wiki/OpenPAM http://www.openpam.org/ https://www.freebsd.org/cgi/man.cgi?apropos=1&query=pam https://www.freebsd.org/cgi/man.cgi?query=pam.conf > * Is hooking PAM the way to go Probably, or quite commonly. More tricky is defining and detecting whatever is considered to be a logout state, timeout, loss of human user, etc. > or should I try to make use of an encrypted > directory mechanism instead? If that is what you want as part of an outcome, then yes. > * If PAM is the way to go, where might I find a working example for using > the login password to unlock a private keystore? See above links. Other people will probably post others. > * Has someone already done this for GPG Agent? Probably. > In addition, one of the layered applications, Mesh/Confirm offers two factor > authentication (among other things) so an example showing how to integrate a > network authentication mechanism would be useful. > > The architecture I am thinking of would be: > > 1) User logs in with password. > > 2) Password is passed to the unlock keys mechanism which uses it to unlock a > master key. > > 3) Processes running under the master key account can request unlocking of > profile data stored under it. > > Of course, it is quite possible that the magic required to bridge the gap > between 2 and 3 means effectively recreating GPGAgent.

3 3

gnupg-agent stores pass phrases until power-off
by Steve Kinney 04 Apr '17

04 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2017 01:44 PM, grarpamp wrote: > On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker > <phill(a)hallambaker.com> wrote: >> * Has someone already done this for GPG Agent? > > Probably. gnupg-agent is in serious need of some bugfixes, at least the version that makes it into Mint. Once it sees a pass phrase, gnupg-agent retains it until the system is shut down; stored pass phrases persist through user logout/login. This behavior is supposed to be controlled by a config file where a timeout can be set, but none is present in the default installations I have seen on Mint, and creating a new gpg-agent.conf as directed in the man page for gnupg-agent does exactly nothing to alter its behavior. The Debian devs say this is a non-issue. Their excuse: "Physical access is game over." How's that for convenient? Never mind that broken gnupg-agent means physical access by any unskilled snooper gives that person the ability to read and copy encrypted documents and files, or apply your signature to anything, while your back is turned. Not an issue. The presence of your pass phrase in system memory, as/when a non-persistent exploit checks to see if pass phrases for the secring keys it just sent to its owner are available in memory is not a potential issue, either. My work-arounds for this BS: http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJY4/dcAAoJEECU6c5XzmuqRZsH/j+n/25kHvoGh67IslBPrw1B 19Bkv4iSTTFf+t7dSNK10r91MzE4Li+m4p1jh2jYmz0Irle+le5gVmKFklDJXj4S UKVzmK89uhYTdUbWIuld+oAX3TIPfCNz88wwAqAl+YljTOrd1hS6hw8YKj62QElg dPRY/og3qsSTUU8mi5d57pae4yqaHQ5Gq9qZkxMIKByz5ZiOsxUoRslwhkWwaMp9 6Bcm2p7BAyKXOE9ZSWUp/0GjyB0BSwuMLgQtj2R4FJDcqIJ4/YLc5SI7OgFSwYjx u3Yy9+XAeF3+nQaVH8woFMPr7MiKHexDpdzQtsAZ1FcF+LF04vJcaFJF11gzvdo= =rTK8 -----END PGP SIGNATURE-----

1 0

gnupg-agent stores pass phrases until power-off
by Steve Kinney 04 Apr '17

04 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2017 01:44 PM, grarpamp wrote: > On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker > <phill(a)hallambaker.com> wrote: >> * Has someone already done this for GPG Agent? > > Probably. gnupg-agent is in serious need of some bugfixes, at least the version that makes it into Mint. Once it sees a pass phrase, gnupg-agent retains it until the system is shut down; stored pass phrases persist through user logout/login. This behavior is supposed to be controlled by a config file where a timeout can be set, but none is present in the default installations I have seen on Mint, and creating a new gpg-agent.conf as directed in the man page for gnupg-agent does exactly nothing to alter its behavior. The Debian devs say this is a non-issue. Their excuse: "Physical access is game over." How's that for convenient? Never mind that broken gnupg-agent means physical access by any unskilled snooper gives that person the ability to read and copy encrypted documents and files, or apply your signature to anything, while your back is turned. Not an issue. The presence of your pass phrase in system memory, as/when a non-persistent exploit checks to see if pass phrases for the secring keys it just sent to its owner are available in memory is not a potential issue, either. My work-arounds for this BS: http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJY4/aFAAoJEECU6c5XzmuqfqkIAKEccOp/KQbJ5AFyK0/Npsbn pwVRaiAokE+WqkclDsLmUmB5vqBu+eg4YJIhj0c2gig/55slyCn74kp8Eu0GlOHF 2/qDddjnu6yz91uQs3uoIffYzKvNTXz06THXSn8DQ/nzQVIdy2g67pO2/OqxVp7j cIex0XA02U2ThQGjMMVpg7EIFRrnmzFx9k+BH5wWI2tiHjPWFz/ISaEfq0xx/RwM FVJTQNGLMmKyHwmo1Nez8ZiM+4eZz3Oz9BdaH4yHnOQpI1z9nYY5jeYlOMuaEs6o TZ1+4XTj4tX6sa3PJj8Z57bBWkyFeZzgRC2aipelssT9ui3+J7Qi1ciEAtbfBRg= =j/Vm -----END PGP SIGNATURE-----

1 0

Re: [Cryptography] Regulations of Tempest protections of buildings
by grarpamp 04 Apr '17

04 Apr '17

On Sun, Apr 2, 2017 at 9:17 PM, Harlan Lieberman-Berg <hlieberman(a)setec.io> wrote: > One thing that may be true (this will vary highly with jurisdictions) is > that buildings which block the effective use of radio bands used by the > fire service may be required to install a repeater. This isn't a /ban/ > on such constructions, but rather an additional requirement for those > who do. Not all jurisdictions will require this, but some will: NYC, > for example, it's section 917.1.2 of the NYc building Code and FC511 of > the New York City Fire Code. > > (Nationally and internationally, the model codes are in Annex O of the > NFPA 1 and IBC 915 / IFC 510. Reviewing these may be difficult; > unfortunately, building codes are proprietary in most jurisdictions.) Sorry but if you can't see the written law, promulgated regulation, or included by reference junk, even as an indigent for lols, then it doesn't exist, you don't have to comply with it, and can't be prosecuted for it. There is a very famous guy (can't find link) who goes around suing FOIA / States / Jurisdictions over this bullshit secret law proprietary copyright trademark access fee crap, and winning. He's also going after inhouse crap like PACER, and farmed out junk like LexisNexis. And prople are trying to go after FISC/FISA/PATRIOT too.

1 0

The ideal IoT gift for beauties
by Georgi Guninski 04 Apr '17

04 Apr '17

The ideal IoT gift for beauties: http://www.theregister.co.uk/2017/04/04/intimate_adult_toy_fails_penetratio… Wi-Fi sex toy with built-in camera fails penetration test

1 0

Susan Rice: "I know nothing!"
by jim bell 03 Apr '17

03 Apr '17

https://www.youtube.com/watch?v=UmzsWxPLIOo Sgt Schulz This kind of news makes Mondays worthwhile! Jim Bell ×

1 0

Mirimir Hacked 8ch.net
by HotwheelsGTA 03 Apr '17

03 Apr '17

∞chan is saving all poster IPs indefinitely. This is the code that matters: [code] event_handler('post-after', function($post) { global $board; $post['ip'] = $_SERVER['REMOTE_ADDR']; $data = json_encode(array('ip' => $post['ip'], 'body' => $post['body_nomarkup'])); for ($i = 0; $i bindValue(':board', $board['uri']); $query->bindValue(':id', $post['id']); $query->bindValue(':data', $crypted); $query->execute()or error(db_error($query)); // Failure is never an option, except when it is. }); Upon review of the vichan source code, I found that the "event_handler" function adds a callback function which is run when the corresponding "event" function is called. For example, event_handler('post-after') runs when event('post-after') is called, which it is called at the end of post.php. Line by line, this function makes JSON of our IPs and our post text. It then puts 10 random bytes at the end of the JSON. It then uses a file called "/srv/sunshine.pem" as a public key to encrypt the JSON with the PHP function "openssl_public_encrypt". It then inserts the JSON, along with the board being posted on and the ID of the post, into a table called "sunshine". The board and ID of post are in the clear, only the post content and IP are crypted in that JSON array. This gives McRonald and Jim the ability to look up the IP of any post they want even if the post is no longer live on the public site.

1 0

Mirimir Hacked 8ch.net
by HotwheelsGTA 03 Apr '17

03 Apr '17

8chans fucked [code]

1 0

[OT] German Concentration Camps Factual Survey Film (aka "Memory Of The Camps")
by Cecilia Tanaka 03 Apr '17

03 Apr '17

"Remember, remember, All we fight for, Remember, remember, All we fight for." ========= German Concentration Camps Factual Survey Film (aka "Memory Of The Camps") # http://www.iwm.org.uk/corporate/projects-partnerships/german-concentration-… Ordered in April 1945 by the Supreme Headquarters Allied Expeditionary Force, the film is an official documentary about German atrocities and the concentration camps compiled with footage shot by combat and newsreel cameramen accompanying troops as they liberated occupied Europe. It was to be the film screened in Germany after the fall of the Third Reich - shown to German prisoners of war wherever they were held. Producer Sidney Bernstein assembled a team at the Ministry of Information that included Editors Stewart McAllister and Peter Tanner; Writers Colin Wills and Richard Crossman; and Alfred Hitchcock, who worked as Treatment Adviser. ========= # https://youtu.be/449ZOWbUkf0 Auschwitz: Drone video of Nazi concentration camp ========== "Denial" (2016, movie) # https://www.theguardian.com/film/2017/jan/29/denial-review-tense-real-life-… # https://en.wikipedia.org/wiki/Denial_(2016_film) # http://www.imdb.com/title/tt4645330/ ========== You can *not* deny the truth. A lie can be repeated hundreds of times, but compulsive lying won't make it true at any moment. It will always be only a lie repeated by irrational liars, a pathological denial of the truth.

5 6

Men Without Work
by Mirimir 03 Apr '17

03 Apr '17

>From John Mauldin's blog.[0] | I have been promising a review of Nicholas Eberstadt’s | very important book, Men Without Work: America’s Invisible | Crisis. The book is relatively short at 216 pages, but it | is packed with meaty facts and insights. ... The “invisible | crisis” that the author is writing about is at the very | center of our economic and political turmoil. | | At its heart, the book is about the fact that there are some | 10 million American men of prime working age (25 to 54) who | have simply dropped out of the workforce, and the great | majority of them have not only dropped out of the workforce, | they have also dropped out from any commitments or | responsibilities to society. It is not just the labor force | they are not participating in; they are not participating | in the normal ebb and flow of community life. | ... | | As we shall see, a single variable – having a criminal record | – is a key missing piece in explaining why work rates and | LFPRs have collapsed much more dramatically in America than | other affluent Western societies over the past two generations. | This single variable also helps explain why the collapse has | been so much greater for American men than women and why it | has been so much more dramatic for African American men and | men with low educational attainment than for other prime-age | men in the United States. That is, with admittedly some license taken, it is arguably the bloody War Against Drugs that has been destroying the US economy and culture. Oops :( 0) http://www.mauldineconomics.com/frontlinethoughts/men-without-work

2 1