- cypherpunks - lists.cpunks.org

US Law To Let ISPs Sell Your Soul
by grarpamp 09 Mar '17

09 Mar '17

http://www.flake.senate.gov/public/_cache/files/628ce252-7079-4e9a-b76c-d11… http://www.flake.senate.gov/public/index.cfm/press-releases?ID=7B9C373D-449… https://politics.slashdot.org/story/17/03/08/2032228/gop-senators-new-bill-… https://arstechnica.com/tech-policy/2017/03/gop-senators-new-bill-would-let… Yesterday, Sen. Jeff Flake (R-Ariz.) and 23 Republican co-sponsors introduced a resolution that would overturn new privacy rules for internet service providers. "If the Federal Communications Commission rules are eliminated, ISPs would not have to get consumers' explicit consent before selling or sharing web browsing data and other privacy information with advertisers and other third parties," reports Ars Technica. "The measure would use lawmakers' power under the Congressional Review Act to ensure that the FCC rulemaking 'shall have no force or effect.' The resolution would also prevent the FCC from issuing similar regulations in the future." From the report: Flake's announcement said he's trying to "protect consumers from overreaching Internet regulation." Flake also said that the resolution "empowers consumers to make informed choices on if and how their data can be shared," but he did not explain how it will achieve that. The privacy order had several major components. The requirement to get the opt-in consent of consumers before sharing information covered geo-location data, financial and health information, children's information, Social Security numbers, Web browsing history, app usage history, and the content of communications. This requirement is supposed to take effect on December 4, 2017. The rulemaking had a data security component that required ISPs to take "reasonable" steps to protect customers' information from theft and data breaches. This was supposed to take effect on March 2, but the FCC under newly appointed Chairman Ajit Pai halted the rule's implementation. Another set of requirements related to data breach notifications is scheduled to take effect on June 2. Flake's resolution would prevent all of those requirements from being implemented. He said that this "is the first step toward restoring the [Federal Trade Commission's] light-touch, consumer-friendly approach." Giving the FTC authority over Internet service providers would require further FCC or Congressional action because the FTC is not allowed to regulate common carriers, a designation currently applied to ISPs.

1 0

Re: Anarchapulco Presentation
by jim bell 09 Mar '17

09 Mar '17

From: Sangy <sangy(a)riseup.net> >Talk about bougie shit. $245 dollars to listen to pseudolibertarians and share space kid-pissed pool. I had only been in Mexico once before: I spent about 6 hours in Juarez in about 1972 with my father and grandfather, while we were on our way from Kansas to California. Back when Juarez was generally safe to go to. I didn't get enough data to determine the "libertarian-ness" of the typical attendee. It was an excellent hotel. I don't know how many "stars" it rated, but it was called the Mundo Imperial. >> "How to find love in anarchapulco" >ROTFL I found out that I have groupies! I got recognized at taxi pickups and on buses. More of them seem to be male, however. <sigh> >How did it feel to share stage with Lauren Southern? Unfortunately, I was busy preparing my speech, and missed out on her presentation. I will definitely be watching her, and other, presentations when they become available on the Internet in a few days. I did meet, and then later saw the presentation of, Roger Ver, nicknamed "Bitcoin Jesus" for his promotion of Bitcoin and digital currencies in general. I had previously read a lot about him. Amazing work. At the end of his last-day presentation, he called my presentation "the best" at that convention. Naturally, I am very grateful. >Also, what'd you talk about? The obvious: My AP essay, 22 years later. https://cryptome.org/ap.htm Explained for the unitiated what it is all about, the fact that nobody seems to have found a flaw after all this time. Explained that I fixed David Friedman's "Hard Problem", and that he hasn't yet acknowledged this fact, even with the 2014 published third edition of his The Machinery of Freedom book. http://www.daviddfriedman.com/MyTalks/MyRecentTalks.html https://voluntaristicsociety.liberty.me/national-defense-the-hard-problem/ × I really needed about 20 more minutes: They gave each speaker 40 minutes. They should give them 55. There was a suggestion at the end of the conference that they increase the time from 9am to 9 pm, which would allow the extra time. Jim Bell

1 0

CrimethInc Ex-Workers Collective: Do the Vault7 Revelations Mean Encryption Is Useless?
by Razer 09 Mar '17

09 Mar '17

End-to-End Encryption 101 : And do the Vault 7 Revelations Mean Encryption Is Useless? By CrimethInc. Ex-Workers Collective - March 8, 2017 If you’ve used the internet at any point since May 2013, you’ve probably heard that you should use encrypted communications. Edward Snowden’s revelation that the National Security Agency logs all of our calls, texts, and emails sparked a surge in the development and use of encryption apps and services. Only a few years later, encryption is widely used for daily communication. If you use any of these encryption tools, you’ve probably also heard the phrase “end-to-end encryption,” or “E2EE.” The name seems straightforward enough: end-to-end means content is encrypted from one endpoint (generally your phone or computer) to another endpoint (the phone or computer of your message’s intended recipient). But what level of security does this promise for you, the user? Since the start of Trump administration, the US Customs and Border Protection (CBP) has increased its invasion of travelers’ privacy. The CBP has been demanding that both US citizens and visitors log into their phones and laptops and hand them over to the CBP for inspection. They’ve also demanded that travelers provide their passwords or log in their social media accounts. Travelers who don’t comply face the threat of being denied entry. Yesterday, Wikileaks publish a trove of leaked CIA documents including knowledge of security vulnerabilities and exploits that the CIA paid for and kept secret from the general public. Now that this information has leaked, it’s no longer just the CIA that knows these vulnerabilities—it’s everyone. The New York Times and others misreported that the CIA had broken the encryption in apps like Signal and WhatsApp, when in fact what the CIA did was target specific people’s Android devices and compromise them. In short, this revelation confirms the importance of using end-to-end encrypted communications, which hinder state-level actors from performing broad spectrum dragnet surveillance. E2EE is still important. > Many reports around Vault 7 have given the impression that > encrypted apps like Signal have been compromised. In fact, the > compromise is at the device level—at the endpoint. There is no reason > to believe the encryption itself does not work. Limitations: Plaintext Endpoints First, it’s important to understand that if you can read a message, it is plaintext—that is, no longer encrypted. With end-to-end encryption, the weak links in the security chain become you and your device, and your recipient and their device. If your recipient can read your message, anyone with access to their device can also read it. An undercover cop could read your message over your recipient’s shoulder, or the police could confiscate your recipient’s device and crack it open. If there is any risk of either of these unfortunate events taking place, you should think twice before sending anything you wouldn’t want to share with the authorities. This particular limitation is also relevant to the recent “Vault 7” reveals, which demonstrate how apps like Signal, WhatsApp, and Telegram may not be useful if an adversary (like the CIA) gains physical access to your device or your contact’s device and is able to unlock it. Many reports around Vault 7 have been somewhat misleading, giving the impression that the apps themselves have been compromised. In this case, the compromise is at the device level—at the endpoint. The encryption itself is still good. Limitations: Targeted Surveillance Considering that you can’t control the level of security of your message’s recipient, you should consider the risk that any message you send them might be read. While rare, there are cases of state powers targeting people with direct surveillance. In these cases, targets may be working with malware-infected devices intended to log all of their incoming and outgoing communications. This compromise functions at the endpoint level, rendering E2EE useless against these specific adversaries. Because it is difficult to know whether you (or your message recipient) are the target of this type of attack, it is always best to default to not sending overly-sensitive information via digital communications. Currently, such attacks appear to be rare, but one should never take risks needlessly. Limitations: Metadata The third thing you should know about E2EE is that it doesn’t necessarily protect your metadata. Depending on how communications are transmitted, logs may still show the time and size of communication, as well as the sender and recipient. Logs may also show the location of both sender and recipient at the time of communication. While this is not typically enough to land someone in jail on its own, it can be useful in proving associations between people, establishing proximity to crime scenes, and tracking communication patterns. All these pieces of information are useful in establishing larger behavioral patterns in cases of direct surveillance. So… Why? So, if end-to-end encryption doesn’t necessarily protect the content of your communications, and still gives up useful metadata, what’s the point of using it? One of the most important things E2EE does is ensure that your data never hits someone else’s servers in a readable form. Since end-to-end encryption starts from the moment you hit “send” and persists until it hits your recipient’s device, when a company—like Facebook—is subpoenaed for your logged communications, they do not have any plaintext content to give up. This puts the authorities in a position in which if they wish to acquire the content of your communications, they are forced to spend a significant amount of time and resources attempting to break the encryption. In the United States, your right to a speedy trial may render this evidence useless to prosecutors, who may not be able to decrypt it quickly enough to please a judge. Mass Surveillance Another use of E2EE serves is to make dragnet surveillance by the National Security Agency and other law enforcement agencies much more difficult. Since there is no point in the middle at which your unencrypted communications can be grabbed, what is grabbed instead is the same encrypted blocks of text available by subpoena. Dragnet surveillance is generally conducted by collecting any available data and subjecting it to automated sorting rather than individual analysis. The use of encryption prevents algorithmic sifting for content, thus making this process much more difficult and generally not worthwhile. Stingrays In addition to NSA’s data collection, federal and state law enforcement agencies around the country have, and frequently use, cell site simulators known as “IMSI catchers” or “Stingrays.” IMSI catchers pretend to be cell towers in order to trick your phone into giving up identifying information, including your location. Cell site simulators also grab and log your communications. As with other methods of interception, encryption means that what is retrieved is largely useless, unless the law enforcement agency is willing to go to the trouble to decrypt it. Encryption At Rest In addition to using end-to-end encryption to protect the content of your messages while they’re being sent, you can use full-disk encryption to protect your information while it’s stored on your device. Proper full-disk encryption means that all of the information on your device is indecipherable without your encryption key (usually a passphrase), creating a hardened endpoint which is much more difficult to compromise. Although encrypting your endpoints is not necessarily protection against some of the more insidious methods of surveillance, such as malware, it can prevent adversaries who gain possession of your devices from pulling any useful data off of them. End-to-end encryption is by no means a magical shield against surveillance by nation states or malicious individuals, but Vault 7 highlights how using it can help force a procedural shift from dragnet surveillance to resource-intensive targeted attacks. When paired with good sense, encrypted devices, and other security practices, E2EE can be a powerful tool for significantly reducing your attack surface. Consistent, habitual use of end-to-end encryption can nullify many lower-tier threats and may even cause some higher-level adversaries to decide that attacking you is simply not worth the effort. --33-- https://itsgoingdown.org/end-end-encryption-101-vault-7-revelations-mean-en…

1 0

NY Post: WikiLeaks takes another shot at America
by jim bell 09 Mar '17

09 Mar '17

Note:. I, Jim bell, think the content of this editorial is utter nonsense. But, "Know thine enemy" WikiLeaks takes another shot at America http://nyp.st/2n7Robo

1 0

happy 8 march to the women
by Georgi Guninski 08 Mar '17

08 Mar '17

happy 8 march to the women

4 3

NY Post: Encryption is hindering FBI's crime-fighting efforts: Comey
by jim bell 08 Mar '17

08 Mar '17

Encryption is hindering FBI's crime-fighting efforts: Comey http://nyp.st/2mYYOkm

1 0

[TriggerWarning: Sexist-Racist-Baiting, cmon...] Selma Burke
by Razer 08 Mar '17

08 Mar '17

You know... THAT "Selma Burke". The Black Woman who never received credit for her portrait of Franklin D, Roosevelt on the US dime. https://twitter.com/Crystal1Johnson/status/838140498841763840 Rr

5 18

Claims begin to surface that Signal, etc not compromised by CIA ZeroDay
by Razer 08 Mar '17

08 Mar '17

From a DailyDot 'staff writer'. > Unfortunate that poorly written explainations by WikiLeaks & NYTimes > forced so many reporters to waste time clarifying this today. DailyDot and Wikileaks aren't exactly on friendly terms because the Dot fronted the cold war trope for US interests that Wikileaks redacted Syria papers about Russian involvement. http://www.theverge.com/2016/9/9/12864328/wikileaks-threat-reporters-syria-… Thread: https://twitter.com/dellcam/status/839280333732315136

2 1

Re: [Cryptography] Crypto best practices
by Ryan Carboni 08 Mar '17

08 Mar '17

Wait, AES with a minimum of 256 bits? Might be a typo, but there's only one AEAD AES with no more than 256-bits right? Is there key whitening? (I find it odd that few algorithms have strong or independently generated whitening keys, particularly given that one of the arguments for 128-bit DES is that it would only have 20% more gates)

1 0

Vault 7: Year Zero
by booty 08 Mar '17

08 Mar '17

hi ceecee ! -- List of japanese faces cia uses ¢‿¢ ©¿© o ª{•_•}ª ¬_¬ ¯＼(º_o)/¯ ¯\(º o)/¯ ¯\_(⊙︿⊙)_/¯ ¯\_(ツ)_/¯ °ω° °Д° °‿‿° °ﺑ° ´ ▽ ` )ﾉ ¿ⓧ_ⓧﮌ Ò,ó ó‿ó ô⌐ô ôヮô ŎםŎ ŏﺡó ʕ••ʔ ʕ•ᴥ•ʔ ʘ‿ʘ ˚•_•˚ ˚⌇˚ ˚▱˚ ''\\=(•●)=//' ° ʖ ° Σ ◕ ◡ ◕ Σ (ﾟДﾟ;） surprised Σ(ﾟДﾟ；≡；ﾟдﾟ) confusion Σ(ﾟДﾟ ) Σ(||ﾟДﾟ) scary Φ,Φ δﺡό σ_σ д_д ф_ф щ（ﾟДﾟщ） < "Dear god why‽ ) щ(ಠ益ಠщ) щ(ಥДಥщ) Ծ_Ծ ‿ _ ˚௰˚づ ˚ᆺ˚ว ᇂﮌᇂ) ๏๏ ๏๏) ◔◔ (××) (●•) (๏๏) (๏ ๏) (ಥ_ಥ) (••) (●•) (●●) (｡•‿•｡) (-•) (–) _ _ ↁﮌↁ ⌤_⌤ ॓_॔ १✌◡✌५ १|˚–˚|५ ਉ_ਉ ଘ_ଘ இ_இ ఠ_ఠ రృర ಠ¿ಠi ಠ‿ಠ ಠ⌣ಠ ಠ╭╮ಠ ಠ▃ಠ ಠ◡ಠ ಠ益ಠ ಠ益ಠ ಠ︵ಠ凸 ಠ , ಥ ಠ.ಠ ಠoಠ ಠ_ృ ಠ_ಠ ಠ_๏ ಠ~ಠ ಡ_ಡ ತಎತ ತ_ತ ಥдಥ ಥ‿ಥ ಥ⌣ಥ ಥ◡ಥ ಥ﹏ಥ ಥ_ಥ <So… Beautiful! ಭ_ಭ ರ_ರ ಸ , ໖ ಸ_ಸ ക_ക อ_อ อ_อ โ๏௰๏ใ ื ๏๏﴿ ๏๏ ๏๏﴿ ๏[-ิิ_•ิ]๏ ๏_๏ ໖_໖ ༺‿༻ ლ(´`ლ) ლ(◉◞౪◟◉‵ლ) ლ(ಠ益ಠლ) y u no guy ლ(╹◡╹ლ) ლ(◉◞౪◟◉‵ლ) ლ,ᔑ•ﺪ•ᔐ.ლ ᄽὁȍ őὀᄿ ᕕ( ᐛ )ᕗ ᕙ(⇀‸↼‶)ᕗ ᕦ(ò_óˇ)ᕤ ᶘ ᵒᴥᵒᶅ ← baby seal ‘︿’ •▱• •✞_✞• •ﺑ• •(⌚_⌚)• •_•) ‷ↂ凸ↂ‴ ‹•.•› ‹› ‹(•¿•)› ‹› ‹(ᵒᴥᵒ)› ‹(•¿•)› ↁ_ↁ ⇎_⇎ ∩(︶▽︶)∩ ∩( ・ω・)∩ happy dog ≖‿≖ ≧ヮ≦ ⊂•⊃_⊂•⊃ ⊂⌒~⊃｡Д｡)⊃ ⊂(◉‿◉)つ ⊂(ﾟДﾟ,,⊂⌒｀つ ⊙ω⊙ ⊙▂⊙ ⊙▃⊙ ⊙△⊙ ⊙︿⊙ ⊙﹏⊙ ⊙０⊙ ⊛ठ⊛ ⋋ō_ō` ━━━ヽ(ヽ(ﾟヽ(ﾟ∀ヽ(ﾟ∀ﾟヽ(ﾟ∀ﾟ)ﾉﾟ∀ﾟ)ﾉ∀ﾟ)ﾉﾟ)ﾉ)ﾉ━━━ ┌∩┐(◕_◕)┌∩┐ ┌( ಠ_ಠ)┘ ┌( ಥ_ಥ)┘ ╚(•⌂•)╝ ╭╮╭╮☜{•_•}☞╭╮╭╮ ╭✬⌢✬╮ ╮(─▽─)╭ ╯‵Д′)╯彡┻━┻ angry guy flipping a table ╰☆╮ □_□ ►_◄ ◃┆◉◡◉┆▷ ◉△◉ ◉︵◉ ◉_◉ ○_○ ●¿●\ ~ ●_● ◔◔ ◔ᴗ◔ ◔ ⌣ ◔ ◔_◔ ◕ω◕ ◕‿◕ ◕◡◕ ◕ ◡ ◕ ◖♪_♪|◗ ◖|◔◡◉|◗ <Huuuuur ◘_◘ ◙‿◙ ◜㍕◝ ◪_◪ ◮_◮ ☁ ☝ˆ~ˆ☂ ☆¸☆ ☉‿⊙ ☉_☉ ☐_☐ ☜❂Ⴢ❂☞ ☜(⌒▽⌒)☞ ☜(ﾟヮﾟ☜) ☜-(ΘLΘ)-☞ ☝☞✌ ☮▁▂▃▄☾ ♛ ◡ ♛ ☽▄▃▂▁☮ ☹_☹ ☻_☻ ☼.☼ ☾˙❀‿❀˙☽ ♀♀ヾ ♥‿♥ ♥╣[-_-]╠♥ ♥╭╮♥ ♥◡♥ ✌♫♪˙❤‿❤˙♫♪✌ ✌.ʕʘ‿ʘʔ.✌ ✌.|•˘‿•˘|.✌ ✖‿✖ ✖_✖ ❐‿❑ ⨀_⨀ ⨀_Ꙩ ⨂_⨂ 〆(・∀・＠) 《〠_〠》【•】_【•】〠_〠〴⋋_⋌〵の� �のニガー? ━━━━━━(ﾟ∀ﾟ)━━━━━━ ニガー? ペ㍕˚\ ヽ(´ｰ｀ )ﾉヽ(๏∀๏ )ﾉヽ(｀Д´)ﾉヽ(ｏ`皿′ｏ)ﾉヽ(`Д´)ﾉ ㅎ_ㅎ 乂◜◬◝乂凸ಠ益ಠ)凸句_句 Ꙩ⌵Ꙩ Ꙩ_Ꙩ ꙩ_ꙩ Ꙫ_Ꙫ ꙫ_ꙫ ꙮ_ꙮ 흫_흫 句_句 ﴾๏๏﴿ O'RLY? ¯\(ºдಠ)/¯ （·×·）（⌒Д⌒）（╹ェ╹）（♯・∀・）⊃ （　´∀｀）☆ （　´∀｀）（゜Д゜）（・∀・） "well" or "good" （・Ａ・） "bad" or "not good" （ﾟ∀ﾟ）（￣へ￣）（ ´☣///_ゝ///☣｀）（つ Д ｀）＿☆（ ´_⊃｀）☆＿｡◕‿‿◕｡｡◕ ‿ ◕｡ !⑈ˆ~ˆ!⑈ !(｀･ω･｡) (¬‿¬) (¬▂¬) (¬_¬) (°ℇ °) (°∀°) (´ω｀) (´◉◞౪◟◉) (´ヘ｀;) (´・ω・｀) (´ー｀) (ʘ‿ʘ) (ʘ_ʘ) (˚இ˚) (๏๏) (ΘεΘ;) (ι´Д｀)ﾉ (Ծ‸ Ծ) (॓_॔) (० ्०) (ு८ு_ .:) (ಠ‾ಠ) (ಠ‿ʘ) (ಠ‿ಠ) (ಠ⌣ಠ) (ಠ益ಠ ╬) (ಠ益ಠ) (ಠ_ృ) (ಠ_ಠ) (ಥ﹏ಥ) (ಥ_ಥ) (๏๏ ) (ღ˘⌣˘ღ) ♫･*:.｡. .｡.:*･ happy with music (ღ˘⌣˘ღ) - no thx (ᵔᴥᵔ) (•ω•) (•‿•) (•⊙ω⊙•) (• ε •) (∩▂∩) (∩︵∩) (∪ ◡ ∪) (≧ω≦) (≧◡≦) (≧ロ≦) (⊙ヮ⊙) (⊙_◎) (⋋▂⋌) (⌐■_■) (─‿‿─) (┛◉Д◉)┛┻━┻ (╥_╥) (╬ಠ益ಠ) (╬◣д◢) (╬ ಠ益ಠ) (╯°□°）╯︵ ┻━┻ table flip (╯ಊ╰) (╯◕_◕)╯ (╯︵╰,) (╯3╰) (╯_╰) (╹◡╹)凸 (▰˘◡˘▰) (●´ω｀●) (●´∀｀●) relieved happy (◑‿◐) (◑◡◑) (◕‿◕✿) cute happy (◕‿◕) (◕‿-) (◕︵◕) (◕ ^ ◕) (◕_◕) (◜௰◝) (◡‿◡✿) (◣_◢) (☞ﾟ∀ﾟ)☞ (☞ﾟヮﾟ)☞ (☞ﾟ ∀ﾟ )☞ (☼◡☼) (☼_☼) (✌ﾟ∀ﾟ)☞ (✖╭╮✖) (✪㉨✪) (✿◠‿◠) (✿ ♥‿♥) (　・∀・) (　･ัω･ั)？ (　ﾟ∀ﾟ)o彡゜えーりんえーりん!! (。・_・。) (つд｀) (づ｡◕‿‿◕｡)づ (ノಠ益ಠ)ノ彡┻━┻ table flip (ノ ◑‿◑)ノ (ノ_・。) (・∀・ ) (屮ﾟДﾟ)屮 "Come on" or "Come here" (︶ω︶) (︶︹︺) (ﺧ益ﺨ) (；一_一) (｀・ω・´)” innocent happy (｡◕‿‿◕｡) (｡◕‿◕｡) (｡◕ ‿ ◕｡) (｡♥‿♥｡) (｡･ω..･)っ (･ｪ-) (ﾉ◕ヮ◕)ﾉ*:･ﾟ✧ (ﾟДﾟ) "heh?" or "what are you saying?" or "surprised" (ﾟДﾟ)y─┛~~ smoking (ﾟ∀ﾟ) (ﾟヮﾟ) (￣□￣) (￣。￣) (￣ー￣) (￣(エ)￣) ( °° ) ( ´_ゝ｀) ( ° ʖ °) ( ~ ʖ °) ( ಠ◡ಠ ) ( •_•)>⌐■-■ ( 　ﾟ,_ゝﾟ) ( ･ิз･ิ) ( ﾟдﾟ)､ vomits saliva ( ^▽^)σ)~O~) ((((゜д゜;)))) (*´д｀*) (*..Д｀) (*..д｀*) (*~▽~) (-’๏_๏’-) (-＿- )ノ (/◔ ◡ ◔)/ (///_ಥ) (;´Д`) (=ω=;) (=゜ω゜) (>'o')> ♥ <('o'<) (n˘v˘•)¬ (o´ω｀o) (V)(°,,°)(V) (\/) (°,,°) (\/) WOOPwoopwowopwoopwoopwoop! (^▽^) (`･ω･´) ← Pedobear? (~￣▽￣)~ /╲/\╭ºoꍘoº╮/\╱\ <【☯】‿【☯】> = (ﾟдﾟ)ｳ @_@ d(*⌒▽⌒*)b o(≧∀≦)o o(≧o≦)o q(❂‿❂)p y=ｰ( ﾟдﾟ)･∵. shot my head \˚ㄥ˚\ \ᇂ_ᇂ\ $ಠ ὡ ಠ )/ \(◕ ◡ ◕$ ^^ ^ㅂ^ _(๏๏)_ {´◕ ◡ ◕｀} {ಠ_ಠ}__,,|, {◕ ◡ ◕}

1 0