- cypherpunks - lists.cpunks.org

multi-party support for axolotl ratchet?
by coderman 02 Jan '14

02 Jan '14

per https://github.com/trevp/axolotl/wiki is there a straightforward way to make this multi-party capable, and what optimizations could be done to reduce keys/messages required? i have not looked at mpOTR in depth yet, to see what lessons might be applicable to axolotl... best regards,

2 1

The Intimidation Factor: How a Surveillance State Can Affect What You Read in Professional Publications
by coderman 02 Jan '14

02 Jan '14

attempting to obtain a copy of: "The Intimidation Factor: How a Surveillance State Can Affect What You Read in Professional Publications" https://www.computer.org/csdl/mags/co/2013/12/mco2013120091-abs.html i appear unable to download successful purchase, "There is no down-loadable article.". does anyone have details on the nature of the pressure to censor in this case? best regards,

1 2

"To Protect and Infect" - the edges of privacy-invading technology
by griffin＠cryptolab.net 01 Jan '14

01 Jan '14

This talk is divided into two parts. Morgan Marquis-Boire and Claudio Guarnieri talking about the militarization of the internet in part one, including both targeted and dragnet surveillance in deep-packet inspection. (See also Citizen Labs' work on BlueCoat). In part two, Jake Appelbaum talks about some of the most hardcore and cutting-edge NSA surveillance tactics and equipment. (See also yesterday's Der Spiegel articles). Part 1: http://www.youtube.com/watch?v=XZYo9TPyNko Part 2: https://www.youtube.com/watch?v=b0w36GAyZIA best, Griffin -- As always, opinions are mine and kittens are cuddly :3 Seriously, go take a kitten break: https://www.youtube.com/results?search_query=fluffy+kittens

3 8

peertech.org cert [was: DEF CON cell network attacks]
by coderman 01 Jan '14

01 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 more details here soon... only 443 should be considered valid - that is, try https://peertech.org first, plain-text must die. and remember lkaglbgpvvcmc6xc.onion in case it becomes necessary Certificate: Data: Version: 3 (0x2) Serial Number: 2b:50:49:6a:55:85:55 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2 Validity Not Before: Dec 3 00:18:04 2013 GMT Not After : Dec 3 00:18:04 2014 GMT Subject: OU=Domain Control Validated, CN=peertech.org Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) Modulus (4096 bit): 00:b7:64:54:f1:2e:3a:ec:11:29:5a:93:1f:ad:f0: 16:8c:9c:eb:d9:0f:49:d2:9d:16:9a:53:a4:60:b6: 23:5b:4f:f3:17:90:77:0a:b3:25:27:f2:27:dd:65: 83:b6:e4:d5:13:b1:3b:97:5d:b5:b9:a9:62:32:4a: 7e:fb:67:73:20:5f:d7:44:52:c8:fc:ca:f8:fb:f1: 4f:d1:9d:94:39:72:12:2b:67:22:4c:0b:dc:7f:31: 34:cf:63:42:f1:c8:3d:ed:7c:de:2f:e2:63:e1:a2: 0a:c9:e6:86:dd:3f:39:73:af:01:58:d7:6d:59:7a: 51:d0:b7:bb:4c:8d:5f:1e:43:10:da:96:09:67:56: 2f:38:f6:a8:44:a7:96:9a:5c:bc:3e:6c:d6:d1:b6: 96:80:34:c8:88:84:4e:2e:06:14:0f:c5:f2:11:ff: f6:15:06:f2:25:e7:d2:1a:8d:62:ef:5c:0e:fb:44: 8e:73:da:96:23:26:03:62:5c:2b:e6:70:5c:87:76: d3:21:59:83:57:ac:56:15:bd:4f:25:fb:df:10:ec: 0e:56:fa:44:c8:8b:a4:97:ea:b1:98:71:3b:51:78: 79:ee:33:cf:b5:a5:68:15:86:9f:31:70:ee:8f:2f: f4:53:32:b7:99:4f:67:21:db:1e:5d:4f:dc:5b:5d: 59:fd:30:3e:a2:04:22:13:76:05:4c:44:d6:08:fe: b5:42:5f:b5:4a:38:4f:3d:eb:ea:59:63:ab:27:87: 7e:c4:46:3b:96:75:41:be:85:7e:e8:b5:8a:d4:11: aa:cc:6a:28:b9:50:a3:f4:45:e2:50:d5:1f:6c:bf: b8:ba:07:10:20:f8:7f:94:ec:15:d7:39:a6:fe:df: 65:78:1d:60:2c:b0:b1:76:40:82:b5:0f:d6:c8:e3: 8b:bb:f3:04:ff:80:e3:de:fc:2c:32:0e:21:13:d5: bd:38:94:a1:c8:53:da:c7:3b:a9:a5:c1:70:ea:89: ef:a7:f8:04:35:41:7e:38:05:73:ff:76:8a:c1:92: 7f:03:b8:76:48:b9:f6:61:b1:c5:22:be:b9:36:73: de:0e:b8:36:4a:9c:c5:66:3b:63:2c:be:4f:20:75: 94:03:d8:05:d0:78:12:df:77:d8:17:51:7e:3c:24: 7f:cc:c6:8e:2a:f7:bc:f8:5c:29:64:bb:10:42:4d: c0:83:64:6f:da:78:14:52:2e:97:49:e8:5d:7f:38: 36:3d:5a:5d:7c:44:71:28:21:04:6e:24:f5:f8:59: 93:1f:e9:d1:3e:6d:6d:db:93:57:8f:44:74:d6:64: e9:2b:b6:33:fd:16:81:92:29:a5:80:6a:1f:2b:78: 66:d3:ed Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 CRL Distribution Points: URI:http://crl.godaddy.com/gdig2s1-6.crl X509v3 Certificate Policies: Policy: 2.16.840.1.114413.1.7.23.1 CPS: http://certificates.godaddy.com/repository/ Authority Information Access: OCSP - URI:http://ocsp.godaddy.com/ CA Issuers - URI:http://certificates.godaddy.com/repository/gdig2.crt X509v3 Authority Key Identifier: keyid:40:C2:BD:27:8E:CC:34:83:30:A2:33:D7:FB:6C:B3:F0:B4:2C:80:CE X509v3 Subject Alternative Name: DNS:peertech.org, DNS:www.peertech.org X509v3 Subject Key Identifier: C6:5E:C0:43:56:84:2E:11:A3:35:C8:AC:A9:70:96:7B:A5:2E:5B:77 Signature Algorithm: sha256WithRSAEncryption b1:ea:a9:16:b6:9c:56:f4:59:99:df:36:69:92:a5:57:48:df: 70:55:a6:1f:5b:51:74:b4:d1:d7:5a:f6:71:e6:92:f2:56:14: 07:f4:2c:14:06:50:4a:e6:f8:32:8c:a1:ed:4b:25:50:fa:05: 99:01:74:db:45:ae:c2:ca:dc:f3:e7:ad:50:1b:12:c2:1e:ea: c8:19:41:db:b0:eb:f1:0c:c7:ba:af:c2:08:9e:7d:3c:c9:de: 5d:7f:ff:9e:c3:cc:54:bd:ac:1f:24:47:17:ae:ba:75:b7:0b: b7:ee:3b:3a:ba:2a:f7:19:19:1a:98:56:35:34:16:8a:ec:ac: 50:f0:45:7c:06:5a:fe:b1:d8:8b:13:94:5b:2c:1c:3d:b6:df: f9:79:69:b0:75:68:b3:e5:01:8e:90:85:bc:bf:92:47:ba:d0: 9c:8c:5d:28:d6:d3:17:58:96:76:ed:bf:65:75:7c:25:58:57: 2f:52:ae:9f:a9:a1:35:92:ca:28:13:b6:ae:a8:89:cf:ce:a6: cd:31:28:42:f7:66:9d:de:38:0d:4c:d5:ae:49:6c:db:92:28: a2:7c:4a:18:8e:7b:b6:0a:c9:d4:8d:0a:82:d4:04:a6:d0:3d: 8c:a6:37:ac:16:98:bd:79:49:83:60:7f:b5:dc:d7:80:aa:5d: ae:f7:11:eb - -----BEGIN CERTIFICATE----- MIIGJTCCBQ2gAwIBAgIHK1BJalWFVTANBgkqhkiG9w0BAQsFADCBtDELMAkGA1UE BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMS0wKwYDVQQLEyRodHRwOi8vY2VydHMu Z29kYWRkeS5jb20vcmVwb3NpdG9yeS8xMzAxBgNVBAMTKkdvIERhZGR5IFNlY3Vy ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjAeFw0xMzEyMDMwMDE4MDRaFw0x NDEyMDMwMDE4MDRaMDoxITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRl ZDEVMBMGA1UEAxMMcGVlcnRlY2gub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A MIICCgKCAgEAt2RU8S467BEpWpMfrfAWjJzr2Q9J0p0WmlOkYLYjW0/zF5B3CrMl J/In3WWDtuTVE7E7l121ualiMkp++2dzIF/XRFLI/Mr4+/FP0Z2UOXISK2ciTAvc fzE0z2NC8cg97XzeL+Jj4aIKyeaG3T85c68BWNdtWXpR0Le7TI1fHkMQ2pYJZ1Yv OPaoRKeWmly8PmzW0baWgDTIiIROLgYUD8XyEf/2FQbyJefSGo1i71wO+0SOc9qW IyYDYlwr5nBch3bTIVmDV6xWFb1PJfvfEOwOVvpEyIukl+qxmHE7UXh57jPPtaVo FYafMXDujy/0UzK3mU9nIdseXU/cW11Z/TA+ogQiE3YFTETWCP61Ql+1SjhPPevq WWOrJ4d+xEY7lnVBvoV+6LWK1BGqzGoouVCj9EXiUNUfbL+4ugcQIPh/lOwV1zmm /t9leB1gLLCxdkCCtQ/WyOOLu/ME/4Dj3vwsMg4hE9W9OJShyFPaxzuppcFw6onv p/gENUF+OAVz/3aKwZJ/A7h2SLn2YbHFIr65NnPeDrg2SpzFZjtjLL5PIHWUA9gF 0HgS33fYF1F+PCR/zMaOKve8+FwpZLsQQk3Ag2Rv2ngUUi6XSehdfzg2PVpdfERx KCEEbiT1+FmTH+nRPm1t25NXj0R01mTpK7Yz/RaBkimlgGofK3hm0+0CAwEAAaOC AbMwggGvMA8GA1UdEwEB/wQFMAMBAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG AQUFBwMCMA4GA1UdDwEB/wQEAwIFoDA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8v Y3JsLmdvZGFkZHkuY29tL2dkaWcyczEtNi5jcmwwUwYDVR0gBEwwSjBIBgtghkgB hv1tAQcXATA5MDcGCCsGAQUFBwIBFitodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFk ZHkuY29tL3JlcG9zaXRvcnkvMHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYY aHR0cDovL29jc3AuZ29kYWRkeS5jb20vMEAGCCsGAQUFBzAChjRodHRwOi8vY2Vy dGlmaWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvZ2RpZzIuY3J0MB8GA1Ud IwQYMBaAFEDCvSeOzDSDMKIz1/tss/C0LIDOMCkGA1UdEQQiMCCCDHBlZXJ0ZWNo Lm9yZ4IQd3d3LnBlZXJ0ZWNoLm9yZzAdBgNVHQ4EFgQUxl7AQ1aELhGjNcisqXCW e6UuW3cwDQYJKoZIhvcNAQELBQADggEBALHqqRa2nFb0WZnfNmmSpVdI33BVph9b UXS00dda9nHmkvJWFAf0LBQGUErm+DKMoe1LJVD6BZkBdNtFrsLK3PPnrVAbEsIe 6sgZQduw6/EMx7qvwgiefTzJ3l1//57DzFS9rB8kRxeuunW3C7fuOzq6KvcZGRqY VjU0ForsrFDwRXwGWv6x2IsTlFssHD223/l5abB1aLPlAY6Qhby/kke60JyMXSjW 0xdYlnbtv2V1fCVYVy9Srp+poTWSyigTtq6oic/Ops0xKEL3Zp3eOA1M1a5JbNuS KKJ8ShiOe7YKydSNCoLUBKbQPYymN6wWmL15SYNgf7Xc14CqXa73Ees= - -----END CERTIFICATE----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iL4EAREKAGYFAlKdOgZfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl bnBncC5maWZ0aGhvcnNlbWFuLm5ldDQxQzEyQjhDMzA3RDdFMjE5OEFBNTc4MTY1 QTg0N0U3QzJCOTM4MEMACgkQZahH58K5OAxRPgD/QkjoUgAe+zqlkKKRNEhRICYp XQADFHeMuIqEF2D6+00BAJF/sZ7od2vyaL85tSJGMjPGi4CvwhJXBGeedxlWPufI =O2TU -----END PGP SIGNATURE-----

2 3

Fwd: [liberationtech] Commotion Wireless source code & downloads
by coderman 01 Jan '14

01 Jan '14

---------- Forwarded message ---------- From: Griffin Boyce <griffin(a)cryptolab.net> Date: Tue, Dec 31, 2013 at 8:54 PM Subject: Commotion Wireless source code & downloads Hi all, Just wanted to shoot a couple of links to the source code for Commotion, since there seemed to be some confusion. The project is kind of huge ^_^;; Source for all packages on github: https://github.com/opentechinstitute Pre-built router images: https://commotionwireless.net/download/routers NOTE: signing key for images is: 0x55A525F8EFE57820BA2A40F7D3F54B1ED01D01F1 Base repo for routers: https://github.com/opentechinstitute/commotion-router (as part of the build process, it pulls in numerous other repos, so be sure to check the make files if you want to hack on it) Android apk: https://commotionwireless.net/download/android Commotion Linux (developer release): https://github.com/opentechinstitute/commotion-linux-py Documentation: https://commotionwireless.net/docs/cck (It's also on github and we accept patches!) https://github.com/opentechinstitute/commotion-docs/ This project is really important to all of us, so if there's a dead link or you find a bug, or you think usability could be improved in some way, or the documentation doesn't cover you -- LET US KNOW! We're all really friendly and are always happy to accept patches or rewrite instructions if that's what's needed. best, Griffin Boyce (Happy New Year!)

1 0

Jim Bell comes to Cypherpunks?
by Jim Bell 01 Jan '14

01 Jan '14

Since the issue was just raised about me needing a PGP key (presumably, for now, just for signing purposes), it occurred to me that the best way to get that key signed would be for me to attend a meeting of Cypherpunks. Since many such meetings occur in the Bay Area (San Francisco and environs) I could come from Vancouver Washington (Just across the Columbia river from Portland) and attend an upcoming Cypherpunks meeting. What I'd appreciate would be a local who could provide transportation (I don't do 'credit card' and they probably wouldn't rent a car to me if I did!), and possibly a place to stay for 2-3 days. Does this sound like a plan? I could bring my BOP (Bureau of Prisons) ID, smuggled out when I was released, and auction it off for bitcoins, to pay for my expenses. (It's sure to be a collector's item someday!) Jim Bell

2 1

Fw: Jacob Appelbaum in Germany
by Jim Bell 01 Jan '14

01 Jan '14

From: James A. Donald <jamesd(a)echeque.com> To: cypherpunks(a)cpunks.org Sent: Tuesday, December 31, 2013 2:54 PM Subject: Re: Jacob Appelbaum in Germany "James A. Donald" >> As to Swartz he didn't commit any real crime so he never was, or pretended >> to be, 'above the law'. >Accessing someone else's computers without permission to obtain the >information therein is trespass. The powerful trespass against the less >powerful. He had mistaken ideas about how powerful he was. My understanding (from reading the Wikipedia article on Swartz an hour ago) was that he accessed "PACER" information. ( http://www.pacer.gov/ ) The information in PACER (which I have used a few times before, for example to access the docket for fake, forged, fraudulent "appeal" case 99-30210) is simply Federal court case files. (Dockets; filings). This material is legally in the public domain: It is not even copyrighted. I don't know if Swartz did anything 'illegal' to get into the computer that had the information, but I doubt that. Incidentally, the charge for PACER documents is now $0.10 per page, but if you run up a charge of less than $15.00 in a calendar quarter, there is no charge. (In other words, less than 150 pages downloaded are free) Jim Bell

2 1

To Protect and Infect Slides
by John Young 31 Dec '13

31 Dec '13

30c3 slides from Jacob Appelbaum: http://cryptome.org/2013/12/appelbaum-30c3.pdf (3.8MB)

1 0

trojan hardware (keyboard black bag implant) circa 2003
by coderman 30 Dec '13

30 Dec '13

out of time, barest gist til next year: back when doing wifi security research and other interests [trunc.] received an FBI black bag job; presumably physical focus due to non standard OSes and FDE. IBM keyboard internal chip replaced with identical logging variant; note that this is not as sophisticated as the more recent TAO toys with covert RF channels and active, on-demand capabilities... the keyboard tampering: https://peertech.org/dist/baghw04.jpg https://peertech.org/dist/baghw05.jpg https://peertech.org/dist/baghw06.jpg which is for all intents and purposes otherwise visually undetectable using this trojan chip technique, tailored for every common manufacturer. while that was not bad, aside from leaking tamper event, the FDE was so sad/funny. a screw amuck, replacement drive significantly different (when compared to identical lot mate purchased with original that got yanked for offline attack) https://peertech.org/dist/baghw01.jpg https://peertech.org/dist/baghw02.jpg https://peertech.org/dist/baghw03.jpg --- in a round about manner this was all instigated in part by wifi research done at the time which put various powerful entities into a tiff. here's what the pacNW sample looked like back in early 2003: https://peertech.org/archives/wifi-scan/ "Cleartext Nodes: 8755 (62.59%) , WEP Nodes: 5232 (37.40%)" ... ah, memories :) --- one last fun learning by example: consider that you thwart direct physical access black bag type attempts, and are not running a vulnerable router/CPE, and present a sufficiently compelling target, you may encounter a clever "just outside the property line" isolation and active attack on DOCSIS uplink. (a broadcast medium is hard to mess with in a covert manner, unless you're able to isolate target from the local broadcast loop itself.) https://peertech.org/dist/docsis-mitm.jpg (circa 2007 - make note of image comments and also single "Comcast tech" shielding self behind door...)

1 2

30c3: To Protect And Infect, Part 2
by coderman 30 Dec '13

30 Dec '13

so much asking for names, details, conspirators. so many months and months of nearly zero satisfaction. ... until: kudos Jake for delivering; specifically. :) "[QI vector] 30c3: To Protect And Infect, Part 2" http://www.youtube.com/watch?v=b0w36GAyZIA --- you can argue some subset of these attacks are exercised in a targeted manner, however, this does nothing to prevent collateral damage to domestic and global individuals, indiscriminately. fuck these guys![0] best regards, 0. fuck you, at least in so far as your offensive efforts to undermine privacy and liberty in the name of route tasking without restraint. to those who go privacy tech repurpose, i will sing your praises and support your efforts!

1 0