- cypherpunks - lists.cpunks.org

Google Pushing U2F
by grarpamp 24 Dec '16

24 Dec '16

https://news.ycombinator.com/item?id=13126880 https://it.slashdot.org/story/16/12/24/0037256/u2f-security-keys-may-be-the… http://fc16.ifca.ai/preproceedings/25_Lang.pdf U2F keys "may be the world's best hope against account takeovers": "The Security Keys are based on Universal Second Factor, an open standard that's easy for end users to use and straightforward for engineers to stitch into hardware and websites. When plugged into a standard USB port, the keys provide a 'cryptographic assertion' that's just about impossible for attackers to guess or phish. Accounts can require that cryptographic key in addition to a normal user password when users log in. Google, Dropbox, GitHub, and other sites have already implemented the standard into their platforms. After more than two years of public implementation and internal study, Google security architects have declared Security Keys their preferred form of two-factor authentication. The architects based their assessment on the ease of using and deploying keys, the security it provided against phishing and other types of password attacks, and the lack of privacy trade-offs that accompany some other forms of two-factor authentication." The researchers wrote in a recently published report: "We have shipped support for Security Keys in the Chrome browser, have deployed it within Google's internal sign-in system, and have enabled Security Keys as an available second factor in Google's Web services. In this work, we demonstrate that Security Keys lead to both an increased level of security and user satisfaction as well as cheaper support cost." Whatever happened to properly secured use of TOTP?

1 0

US Govt Targets Pirate Bay, Piracy Havens, Notorious Markets
by grarpamp 23 Dec '16

23 Dec '16

https://torrentfreak.com/us-government-targets-pirate-bay-and-other-piracy-… https://ustr.gov/about-us/policy-offices/press-office/press-releases/2016/d… https://ustr.gov/sites/default/files/2016-Out-of-Cycle-Review-Notorious-Mar… https://ustr.gov/sites/default/files/USTR-2015-Out-of-Cycle-Review-Notoriou… https://en.wikipedia.org/wiki/Notorious_markets The US Government has listed some of the largest piracy websites and other copyright-infringing venues. The USTR calls on foreign countries to take action against popular piracy sites such as The Pirate Bay, which has important "symbolic value," according to the authorities. In addition, stream-ripping is mentioned as an emerging threat. In its yearly “Out-of-Cycle Review of Notorious Markets”, the United States Trade Representative (USTR) has listed more than a dozen websites said to be involved in piracy and counterfeiting. The overview is largely based on input from industry groups including the RIAA and MPAA, who submitted their recommendations a few weeks ago. Absent are lists of many such sites that exist on encrypted overlay darknets.

1 0

Re: Photojournalists & filmmakers want cameras, to be encrypted
by grarpamp 23 Dec '16

23 Dec '16

>>http://chdk.wikia.com/wiki/CHDK http://chdk.wikia.com/wiki/Lua http://chdk.wikia.com/wiki/Canon_Basic http://chdk.wikia.com/wiki/Official_Canon_firmware_updates#Decrypters https://chdk.setepontos.com/index.php?topic=11229 https://chdk.setepontos.com/index.php?topic=6119 http://magiclantern.wikia.com/wiki/Firmware_file http://magiclantern.wikia.com/wiki/Fir_Security http://magiclantern.wikia.com/wiki/ReverseEngineering_tools http://www.magiclantern.fm/ http://www.magiclantern.fm/forum/ http://www.magiclantern.fm/forum/index.php?topic=9963;all http://www.magiclantern.fm/forum/index.php?topic=10279;all http://nikonhacker.com/ You can see that these cameras are using XOR / AES / SHA1 / RSA etc to handle firmware updates, and some of the keys are known. And can execute user supplied scripts down to binary bit banging. Whether the routines are in hw or sw, and are capable of writing not just reading, you'd have to look into it. If it's usable, they certainly would welcome any development help. Or you could start a crypto project to run alongside them. Many in the forums are tinkering with image crypto... :) https://youtu.be/UuMvyp1dT2w https://youtu.be/G9JAlhT1M1k So jump in, develop it, and spread it to more cameras...

1 0

EUCourtOfJustice Says Data Retention Not Cool
by grarpamp 23 Dec '16

23 Dec '16

http://curia.europa.eu/juris/document/document.jsf?docid=186492&doclang=EN The European Union’s top court has severely undermined the British government’s mass surveillance powers in a new ruling that could rein in police and spy agency investigations. In a judgment handed down in Luxembourg on Wednesday, the European Court of Justice declared that the “general and indiscriminate retention” of data about people’s communications and locations was inconsistent with privacy rights. The court stated that the “highly invasive” bulk storage of private data “exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society.” Camilla Graham Wood, legal officer with the London-based group Privacy International, hailed the ruling as a victory for civil liberties advocates. “Today’s judgment is a major blow against mass surveillance and an important day for privacy,” she said. “It makes clear that blanket and indiscriminate retention of our digital histories — who we interact with, when and how and where – can be a very intrusive form of surveillance that needs strict safeguards against abuse and mission creep.” The European court’s panel of 15 judges acknowledged in their ruling that “modern investigative techniques” were necessary to combat organized crime and terrorism, but said that this cannot justify “the general and indiscriminate retention of all traffic and location data.” Instead, the judges stated, it is acceptable for governments to engage in the “targeted retention” of data in cases involving serious crime, permitting that persons affected by any surveillance are notified after investigations are completed, and that access to the data is overseen by a judicial authority or an independent administrative authority. The case was originally brought in December 2014 by two British members of parliament, who challenged the legality of the U.K. government’s Data Retention and Investigatory Powers Act, which forced telecommunications companies to store records on their customers’ communication for 12 months. That law has since been replaced by the Investigatory Powers Act, which was recently approved by the British parliament and is expected soon to come into force. Though the U.K. voted to leave the European Union earlier this year, Wednesday’s decision remains — at least in the short term — highly significant, and will prove to be a severe headache for British government officials. The ruling will now be forwarded to the U.K.’s Court of Appeal, where judges there will consider how to apply it in the context of national law. It may result in the government being forced to make changes to controversial sections of the Investigatory Powers Act, which enable police and spy agencies to access vast amounts of data on people’s internet browsing, instant messages, emails, phone calls, and social media conversations. “This is the first serious post-referendum test for our government’s commitment to protecting human rights and the rule of law,” said Martha Spurrier, director of U.K. human rights group Liberty. “The U.K. may have voted to leave the EU — but we didn’t vote to abandon our rights and freedoms.” She added: “Today’s judgment upholds the rights of ordinary British people not to have their personal lives spied on without good reason or an independent warrant. The government must now make urgent changes to the Investigatory Powers Act to comply with this.” A spokesperson for the British government’s Home Office said in a statement: “We are disappointed with the judgment from the European court of justice and will be considering its potential implications. The government will be putting forward robust arguments to the court of appeal about the strength of our existing regime for communications data retention and access.”

1 0

What is the importance of antimatter?
by Georgi Guninski 23 Dec '16

23 Dec '16

What is the importance of antimatter? As is known, I don't understand physics. The front page of wikipedia links to new results in antimatter related to antihydrogen. https://en.wikipedia.org/wiki/Antihydrogen What is the importance of antimatter not counting nukes? Why antimatter is accepted by the standard model in physics, but anti-time and anti-space appear to be considered cranky topic? Could it be currently we don't have measuring devices and enough precision to detect anti-time and anti-space and the imaginary (in the complex sense) stuff from the square root of negative real in the Lorentz transformations, closely related to relativity?

3 2

Value of bitcoins in circulation hits record high of $14bn
by grarpamp 23 Dec '16

23 Dec '16

Price per coin at $875 as cryptocurrency’s value doubles in a year, with experts linking it to depreciation of Chinese yuan The total value of all bitcoins in circulation hit a record high above $14bn (£11bn) on Thursday, as the web-based digital currency jumped 5% to its highest levels in three years after more than doubling in price this year. The price of one bitcoin reached $875 on the Europe-based Bitstamp exchange, its strongest level since January 2014, putting the cryptocurrency on track for its best daily performance in six months. That compared with levels around $435 at the start of the year, with many experts linking bitcoin’s rise with the steady depreciation of the Chinese yuan, which has slid almost 7% in 2016. Is bitcoin the answer if traditional investments are letting you down? Data shows the majority of bitcoin trading is done in China, so any increase in demand from there tends to have a significant impact on the price. The web-based bitcoin currency can move money across the globe quickly and anonymously with no need for a central authority. That makes it attractive to those wanting to get around capital controls, such as China’s. The currency is still some way off the peaks it scaled in late 2013, when it traded as high as $1,163 on the Bitstamp exchange. But because more bitcoins continue to be added to the system, currently at a rate of 12.5 every 10 minutes, its total value – or “market cap” – on Thursday surpassed the 2013 peak of $14.01bn. That puts its total value at about the same as that of an average FTSE 100 company. Charles Hayter, the founder of data analysis website CryptoCompare, said bitcoin had been helped higher by demonetisation in India, and by global political uncertainty. “If that trend continues, bitcoin is a good thematic play on the fracturing of our global norms as a flight to safety,” he said.

3 8

"right" vs permission, to immigrate - "Japan: No Muslims, no terrorists"
by Hashist 23 Dec '16

23 Dec '16

> Cecilia Tanaka: > in my country, we [are] 'racist' Onli rasict iz yu An doze whu ack raice Othurist slym

1 0

US Congress Classified Report On Snowden
by grarpamp 23 Dec '16

23 Dec '16

https://yro.slashdot.org/story/16/12/22/2040202/congressional-report-claims… http://intelligence.house.gov/UploadedFiles/HPSCI_Snowden_Review_Declassifi… http://www.usnews.com/news/articles/2016-12-22/in-declassified-edward-snowd… https://tcf.org/content/commentary/house-intelligence-committees-terrible-h… https://twitter.com/Snowden Edward Snowden has been in contact with Russian intelligence officials since arriving in Russia in 2013, according to a new report from Congress. "Since Snowden's arrival in Moscow, he has had, and continues to have, contact with Russian intelligence services," the 33-page report, issued Thursday by the bipartisan House Permanent Select Committee on Intelligence, said. Snowden, the former National Security Agency contractor who leaked volumes of information on American intelligence and surveillance operations to the media, settled in Moscow after initially traveling to Hong Kong following his 2013 public disclosure of classified information. The Russian government granted asylum to Snowden shortly thereafter. Large portions of the pertinent section, entitled "foreign influence," are redacted, but one paragraph reveals the Russian link, saying that Frants Klintsevich, the deputy chairman of the Russian parliament's defense and security committee, "publicly conceded that 'Snowden did share intelligence' with his government." Snowden immediately took to Twitter following the report's release to dispute the accusations, writing "they claim without evidence that I'm in cahoots with the Russians." The report cites classified material in the section linking Snowden to Russian intelligence. The investigation also noted that Snowden left encrypted hard drives containing classified information in Hong Kong and that the CIA had refused to grant Snowden access to sensitive information years before he began working with the NSA, documenting numerous issues that Snowden had with supervisors and co-wokers during his various jobs in the intelligence community.

1 0

Re: [Cryptography] Photojournalists & filmmakers want cameras, to be encrypted
by grarpamp 22 Dec '16

22 Dec '16

On Wed, Dec 21, 2016 at 11:57 AM, Joshua Marpet <joshua.marpet(a)guardedrisk.com> wrote: > I'm possibly being naive, but I don't see encryption (past hashing) as > needed. tell me where I'm wrong? Encryption _options_ are definitely *required*. You don't want to turn it on, fine, don't. Some will ship that way. Some other user does, fine, they will. Some will ship that way. And if people are that dense as to their need and use case, consider all the millions of everyday completely legal non journo, innocent, camera users who do stuff like... use it as a photocopier / scanner / fax for their bank docs etc take pics / vids of their families / vacations / drunk aunt donna their contacts and message streams their bedroom escapades whatever ... and are even just slightly aware of privacy, or even if not who would simply just freak out and think about it for years if something as simple as lose / stolen their camera / sdcard / phone. For people to sit here and argue that strong crypto *options* aren't useful... these people need to [have their heads] be examined.

2 1

NIST Wants PQC Code From You
by grarpamp 22 Dec '16

22 Dec '16

https://www.nist.gov/news-events/news/2016/12/nist-asks-public-help-future-… https://www.federalregister.gov/documents/2016/12/20/2016-30615/announcing-… http://csrc.nist.gov/groups/ST/post-quantum-crypto/minimum-accept-reqs.html

2 2