- cypherpunks - lists.cpunks.org

Gmail's receiving mostly authenticated email
by Bill Stewart 16 Dec '13

16 Dec '13

Saw an interesting article from Gmail on their inbound email statistics. Over 91% is authenticated with either DKIM or SPF. 75% is both, the rest is one or the other. That doesn't indicate how much is encrypted, but anything that has the framework to do that authentication could fetch a key as well. (Doesn't stop the feds from collecting the mail after Gmail receives it, of course, but it's an indication of how much email could relatively easily add some encryption to reduce in-transit eavesdropping.)

5 5

Re: Bruce Schneier to leave BT
by John Young 16 Dec '13

16 Dec '13

Would be great for the other dual-hats to follow Schneier's example, with fuller accounts of what has been going on behind NDAs and clearances. A dripped released is hardly sufficient, maybe justifiably suspicious. Remains to be seen if all spy ties are severed or just go darker and deeper, as usual, into the repurposed Black Chamber to hide with celebrity and outrage what is blatantly devious -- in the crypto legacy manner. Isn't that what this unfettered open forum dumpster is urging duplicitously from DoB of cryptoanarchy? Whither cryptoanarchy's billionaire, if not TLAs, Soros, Sim, Murdoch, Gates, Ellison, Bezos, Omidyar, Kochs, Saudis, Russians, Windsors, China, Kuwait, Oman, Ford, Rockefeller, so many, so sneaky. As Assange said to early charges of CIA/Soros funding, "we should be so lucky, all donations welcomed." Word. At 11:29 AM 12/16/2013, you wrote: >retaliation for helping expose intelligence community excesses and >illegalities?

2 2

Bruce Schneier to leave BT
by coderman 16 Dec '13

16 Dec '13

retaliation for helping expose intelligence community excesses and illegalities?

2 1

Re: Wyden spends weeks preparing for questions to intelligence officials
by John Young 16 Dec '13

16 Dec '13

http://cryptome.org/2013/12/spies-reign-obama.htm

1 0

Alleged NSA co-worker describes Snowden
by Gregory Foster 16 Dec '13

16 Dec '13

Forbes (Dec 16) - "An NSA Coworker Remembers The Real Edward Snowden: 'A Genius Among Geniuses'" by @a_greenberg: http://www.forbes.com/sites/andygreenberg/2013/12/16/an-nsa-coworker-rememb… > The anonymous NSA staffer’s priority in contacting me, in fact, was to refute stories that have surfaced as the NSA and the media attempt to explain how a contractor was able to obtain and leak the tens of thousands of highly classified documents that have become the biggest public disclosure of NSA secrets in history. According to the source, Snowden didn’t dupe coworkers into handing over their passwords, as one report has claimed. Nor did Snowden fabricate SSH keys to gain unauthorized access, he or she says. > > Instead, there’s little mystery as to how Snowden gained his access: It was given to him. HT @WeldPond: https://twitter.com/WeldPond/status/412623997272989697 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 0

Wyden spends weeks preparing for questions to intelligence officials
by coderman 16 Dec '13

16 Dec '13

an interesting read on the state of things. Wyden does Oregon proud, [only excerpted, whole thing is huge. waiting for cryptome to mirror... ] http://www.newyorker.com/reporting/2013/12/16/131216fa_fact_lizza?currentPa… """ Wyden estimates that he gets about fifteen minutes a year to ask questions of top intelligence officials at open hearings. With the help of his intelligence staffer, John Dickas, a thirty-five-year-old from Beaverton, Oregon, whom Wyden calls “the hero of the intelligence-reform movement,” Wyden often spends weeks preparing his questions. He and Dickas look for opportunities to interrogate officials on the gaps between what they say in public and what they say in classified briefings. At a technology conference in Nevada the previous summer, General Keith Alexander, the director of the N.S.A., had said that “the story that we have millions or hundreds of millions of dossiers on people is absolutely false.” Wyden told me recently, “It sure didn’t sound like the world I heard about in private.” For months, he tried to get a clarification from the N.S.A. about exactly what Alexander had meant. Now he had the opportunity to ask Clapper in public. As a courtesy, he had sent him the question the day before. Wyden leaned forward and read Alexander’s comment. Then he asked, “What I wanted to see is if you could give me a yes or no answer to the question ‘Does the N.S.A. collect any type of data at all on millions or hundreds of millions of Americans?’ ” Clapper slouched in his chair. He touched the fingertips of his right hand to his forehead and made a fist with his left hand. “No, sir,” he said. He gave a quick shake of his head and looked down at the table. “It does not?” Wyden asked, with exaggerated surprise. “Not wittingly,” Clapper replied. He started scratching his forehead and looked away from Wyden. “There are cases where they could inadvertently perhaps collect, but not wittingly.” Wyden told me, “The answer was obviously misleading, false.” """

1 0

Re: [Cryptography] Size of the PGP userbase?
by grarpamp 16 Dec '13

16 Dec '13

> Phillip H-B, et al have been saying... > [email encryption, etc] > What is the gap we have to close to turn this on by default? How many times has this been rehashed the last six months? You can't fix email as we know it today using todays bolt-ons, protocols and corporate stakeholders/services trying to profit from it. The only way to have any real global seamless success is to go ground up with a completely new model. IMO, that will be some form of p2p message system where every address is a crypto key, masked for grandma by her contact list, decrypted out your p2p daemon and piped into your local mail processing (MUA/filter/lists) and filesystem (encryption). At least that way your local mail tools will still work (no one will give those up anyway). The problem is the antique centralized backend, it needs bypassed. You've got neat stuff like Tor, bittorrent, bitcoin, etc already... so boost email into the 2020's the same way. Then let the old world email services try to keep up, and slowly die like everything else.

3 6

fallout of NSA induced difficulties (lots of drinking, self medication)
by coderman 16 Dec '13

16 Dec '13

this is what happens when large sums of money are secretly spent to prevent the event of secure inter-net: (NIST could simply be bought, but IETF had to be turned in on itself..) ;P --- "IETF PKIX meeting minutes from the 56th IETF" http://www.cs.auckland.ac.nz/~pgut001/misc/minutes.txt We were somewhere in San Francisco on the edge of the 56th IETF when the drugs began to take hold. I remember saying something like "I feel a bit lightheaded; maybe you should take notes...." And suddenly there was a terrible roar all around us and the sky was full of what looked like huge OIDs, all swooping and screeching and diving around the RFC, which was about a hundred pages long. And a voice was screaming: "Holy Jesus! Where are these goddamn business cases?" Then it was quiet again. My attorney had taken his shirt off and was pouring beer into his mouth, to facilitate the PKI standards-creation process. "What the hell are you yelling about?" he muttered, staring up at the neon lights with his eyes closed and covered with wraparound Spanish sunglasses. "Never mind," I said. "It's your turn to figure out the interop requirements." I hit the brakes and dropped the Great Pile of Paperwork at the side of the room. No point mentioning those OIDs, I thought. The poor bastard will see them soon enough. We had two bags of X.509 standards, seventy-five pages of PKIX mailing list printouts, five sheets of high-powered constraints, a saltshaker half-full of vendor hype, and a whole galaxy of requirements, restrictions, promises, threats... Also, a quart of OSI, a quart of LDAP, a case of XML, a pint of raw X.500, and two dozen PGPs. Not that we needed all that for the trip, but once you get into a serious PKI RFC binge, the tendency is to push it as far as you can. The only thing that really worried me was the X.500. There is nothing in the world more helpless and irresponsible and depraved than a man in the depths of an X.500 binge, and I knew we'd get into that rotten stuff pretty soon.

1 0

Re: request for transcript: Bruce Schneier and Eben Moglen discuss a post-Snowden Internet
by Juan Garofalo 16 Dec '13

16 Dec '13

--On Sunday, December 15, 2013 6:11 PM -0800 coderman <coderman(a)gmail.com> wrote: > Video: > https://archive.org/details/schneier > Audio: > http://www.softwarefreedom.org/events/2013/a_conversation_with_bruce_sch > neier/ > more shameless tor advertising at 31:30 interestingly enough, the guy asking the questions isn't buying schneier's bullshit.

1 0

Re: The next generation secure email solution
by grarpamp 15 Dec '13

15 Dec '13

Moving the last couple days talk to this thread seems fine. On Sun, Dec 15, 2013 at 3:19 PM, Ralf Senderek <crypto(a)senderek.ie> wrote: > On Sun, 15 Dec 2013 grarpamp wrote: > >> The only way to have any real global seamless success is to go >> ground up with a completely new model. IMO, that will be some >> form of p2p message system where every address is a crypto key, >> masked for grandma by her contact list, decrypted out your p2p >> daemon and piped into your local mail processing (MUA/filter/lists) >> and filesystem (encryption). At least that way your local mail tools >> will still work (no one will give those up anyway). > > > If you are so sure, can you tell us how the next generation secure email > solution will solve the "trust problem", please. Though unclear, that sounds like the old trust of a CA/PKI system problem. > How does the p2p daemon > find the correct crypto key, so that every user can rely on its invisible > performance? In general I suggest that people wish to use messaging with each other once they already know them (or have some other trusted web to them). As in, Hey John, nice to meet ya today, what's your key (address), I'll message you later. Or Hey Jane, what's John's address. Same for employers, businesses, etc. Such peer groups bootstrap and grow very fast. Thus the perceived need for a cold lookup of Ralf, isn't much of a real one. Once you know the address (node crypto key), you put it 'To: <key>', mua hands to spool, p2p daemon reads spool, looks up key in DHT and sends msg off across the transport to the far key (node) when it is reachable. Hopefully the transport looks like I2P/Tor in being a secure random hop layer. In fact, those could probably be used today, they have the keys as nodes and user facing ports for inbound/outbound daemons. They just need scaling work to n-billion nodes (users, aka: the hard part). People are already plugging postfix, bittorrent, etc into these networks. Tor is not currently addressible at the user level by the full key, it 'shortens' the key into a 16char onion address. As you may be hinting at... yes, that is bad... collisions, and needing secondary lookup layers into the full key. Tor may be moving to full key addressibility soon, see tor-dev for that. I2P (and Phantom, and probably GnuNet) are addressible with full keys. So you can send to 'account@key' with them if you want, and keep the John/Jane/Ralf human style lookups in your MUA addressbook (once you know them) without needing a secondary lookup layer into the full key. No, I am not sure. But when looking at some of the p2p transport layers that have come along so far, it seems like a fairly strong possibility for a new backend transport model while retaining user level mail tools... mutt, maildrop, mailman, Thunderbird, etc. Most of what you'd need there is support for very long addresses and split horizon handoff to local daemon/spool based on recognizing what the destination net is... .onion, .i2p, etc. I'd like to read what Pond and I2P-Bote are doing with some parts of this as well. I don't believe you need a trusted CA/PKI service to successfully bootstrap users and their addresses/keys into a new global messaging system. If I want to know what some unknown like Bruce's key is, I'll look it up on his website, social net, list posts, etc. If that's what you mean.

1 0