- cypherpunks - lists.cpunks.org

TOR Project: Still coming unwrapped
by Steve Kinney 18 Aug '16

18 Aug '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Holy F Society, the TOR Project just came unwrapped. MORE. This essay keeps getting more outrageous, without losing credibility, until it turns a corner that "network security" people could easily attribute to hostile tradecraft. https://shiromarieke.github.io/tor -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXtUn5AAoJEECU6c5XzmuqHbQH/182mmOyXQsN6MigrmS4WhI4 xxVoNJoXwt1DBctCMC1eMq1o/… [View More]

3 3

Riffle: an efficient communication system with strong anonymity
by grarpamp 17 Aug '16

17 Aug '16

http://news.mit.edu/2016/stay-anonymous-online-0711 https://dspace.mit.edu/handle/1721.1/99859 https://people.csail.mit.edu/devadas/pubs/riffle.pdf https://dspace.mit.edu/bitstream/handle/1721.1/99859/927718269-MIT.pdf

9 14

Is it fun owning augmented reality? Internet of Things?
by Georgi Guninski 17 Aug '16

17 Aug '16

Is it fun owning augmented reality? Or the Internet of Things? Any 'real reality' damages? http://www.ibtimes.co.uk/pokemon-go-security-flaw-enables-hacker-take-over-… Pokemon Go security flaw enables hacker to take over gyms in London and New York using eggs

1 0

Hedge fund manager profited from death arbitrage.
by jim bell 17 Aug '16

17 Aug '16

https://www.bloomberg.com/view/articles/2016-08-16/hedge-fund-manager-profi… "A vital function of the financial system is to shift risk, but that is mostly a euphemism. Finance can't make risks go away, or even really move them all that much. When the financial system shifts the risk of X happening from Y to Z, all that means is that Z gives Y money if X happens. If X was going to happen to Y, it's still going to happen to Y. But now Y gets money. Death is a … [View More]

4 5

Weed, USPS, Tor... cypherpunk [was: Tor Browser]
by grarpamp 17 Aug '16

17 Aug '16

On 8/16/16, John Newman <jnn(a)synfin.org> wrote: > Awful lot of dope makes its way through USPS, with TOR as the medium for > setting up delivery, every day all day... Just log in to alphabay and browse > around ... ;) > > But, who knows how long they'll last, there might be sealed indictments > already... Great thing is... this is all testing a whole lot of new ground. >From anonymous overlay networks, delivery / drop models, comms tools, law enforcement, crypto, … [View More]

2 1

Fwd: [liberationtech] Tor Browser 6.0.4 is ready for testing
by Cecilia Tanaka 17 Aug '16

17 Aug '16

Uff... Some months ago, I would be happy. Now, it means nothing... :(( ---------- Forwarded message ---------- From: "Yosem Companys" <companys(a)stanford.edu> Date: Aug 15, 2016 12:10 PM Subject: [liberationtech] Tor Browser 6.0.4 is ready for testing To: "Liberation Technologies" <liberationtech(a)lists.stanford.edu> Cc: "Georg Koppen" <gk(a)torproject.org> From: Georg Koppen <gk(a)torproject.org> Hi all, We are pleased to accounce that Tor Browser 6.0.4 is ready … [View More]

6 14

Re: [liberationtech] Interesting things in keyservers
by Eugen Leitl 17 Aug '16

17 Aug '16

----- Forwarded message from micah <micah(a)riseup.net> ----- Date: Sat, 20 Jul 2013 10:05:42 -0400 From: micah <micah(a)riseup.net> To: Micah Lee <micahflee(a)riseup.net>, 'liberationtech' <liberationtech(a)lists.stanford.edu> Subject: Re: [liberationtech] Interesting things in keyservers User-Agent: Notmuch/0.15.2 (http://notmuchmail.org) Emacs/24.3.1 (x86_64-pc-linux-gnu) Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> Hi Micah! Micah Lee <… [View More]micahflee(a)riseup.net> writes: > I'm working on a talk for OHM2013 about PGP. Can anyone send me examples > of interesting keys in key servers that you know of? Since you are preparing a talk about the subject, I'm going to be pedantic and correct your usage of "PGP", because it is important to get your terminology straight when giving a talk. I presume you aren't giving a talk about the commercial software, but instead you are actually giving a talk about OpenPGP which is the standard specified by RFC4880 that different programs like GnuPG, Seahorse, MacGPG, and PGP etc. all implement. If that is true, then you should refer to it as OpenPGP, and not PGP. I dont know what your talk will consist of, besides the funny enigmail XSS and goatse.cx stuff (thanks for that! always good to have some goatse early in the morning), but I would like to point out a few things that might be useful to mention. One is a wiki page that I created with some people: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices - it contains some useful hints about using OpenPGP, maintaining a good key and some general good practices that people often dont know about (such as the importance of keeping your keys updated to get critical revocation and expiration extension certifications!) One thing mentioned on that page that I wanted to highlight, because you used pgp.mit.edu links in your original email, is that the keyserver pgp.mit.edu is not a good one to use/promote. Everyone uses it as their 'goto' keyserver, but it is a really bad idea! As a keyserver, it has been broken for years. For a long time it was just dropping revocations, subkey updates and expirations on the floor. That is *really* bad. Eventually, they upgraded their keyserver software, but it is *still* running an older version of SKS, a version that fails to handle 16-digit subkeyid lookups (among other failings). So, please don't rely on pgp.mit.edu for your security, and please don't include them in your slides! If you are looking for one to use, I highly recommend using the SKS pool address (hkp://pool.sks-keyservers.net or http://hkps.pool.sks-keyservers.net/ - or if you want a more close geographical pool, have a look at http://sks-keyservers.net/overview-of-pools.php) Finally, there seems to be some amazing misconceptions about keyservers, keys and the web of trust. In particular this http://cryptome.org/2013/07/mining-pgp-keyservers.htm circulated recently and it pained me to see because it suggested various wreckless conclusions that were dangerously off the mark[0] (and used pgp.mit.edu, hah). While it is true that we've jokingly called the OpenPGP web of trust "the original social network" because of the exposed social relational graphing that can be done by querying keyservers, and it is for this reason that many activists I know do not want to have signatures uploaded to keyservers (and instead use the bulky local-only signature work-around)... ... but for some reason people seem to think that if it is on a keyserver, is true, or it means something that it doesn't. People don't realize critical things, such as the fact that I can create a key with the UID Nadim Kobeissi and upload it to the keyservers[1]. That doesn't mean that is the real Nadim's key (this is what exchanging key fingerprints and doing certifications is for, so you can know, with a certain degree of certainty, that this person is the person who controls that secret key material). Or people think that because I signed your key and that signature is on the keyserver that indicates: I trust you; we met in person at that date; we know each other; we are involved in a criminal conspiracy with each other; or many other wrong assumptions about what that certification means. I can sign Edward Snowden's key and send that to the keyservers[1]. Hell, I can sign Snowden's key with my fake Nadim Kobeissi key[1] and then send it to the keyservers. Does that mean that Nadim and Snowden have met in person?! No, it does not at all. Anyways, I can keep going... but I dont know what the focus of your OHM talk is about, so going on like this isn't particularly useful to you and your talk... however, I'd be happy to provide more feedback about your talk if you would like![2] After all, we Micahs need to stick together, micah 0. "the cryptome article just sounds like impenetrable bullshit from someone with no interest in actually understandning what's happening" - I'm not saying who said this... 1. no, I didn't do that, nor did I upload the edward snowden or bradly manning keys. -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5 [View Less]

4 3

US drug policy -> maintains the class divide
by Zenaan Harkness 16 Aug '16

16 Aug '16

>From a comment on slashdot - I'm not American, but this sounds quite plausible to me: http://news.slashdot.org/story/15/11/27/1343243/lsd-microdosing-gaining-pop… " If you're a $100k/yr engineer (Score:4, Insightful) by rsilvergun (571051) on Friday November 27, 2015 @10:52AM (#51013395) such things don't apply. In America we have a multi-tiered justice system. It's pretty well documented. Wealthy and educated people get treatment programs, while poor (and let's face it, black) people get … [View More]

3 3

Exchange / Trading / Analysis Software [re: Zenbot3 BTC/ETH/LTC bot]
by grarpamp 16 Aug '16

16 Aug '16

On 8/16/16, Carlos Rodriguez <carlos(a)s8f.org> wrote: > zenbot is an automated cryptocurrency trading bot. It runs on node.js and > MongoDB and is fully open-sourced. A plugin architecture is included that > allows any exchange, trade strategy, or currency pair to be supported. > > • Default support for GDAX is included, so if you have a GDAX account, > • Default support for other exchanges is ongoing. > instead of trading on GDAX, you could trade on a different … [View More]

1 0

[liberationtech] Tor Browser 6.0.4 is ready for testing
by vroom＠mail2tor.com 16 Aug '16

16 Aug '16

> Rayzer: > run off thumbdrive > leave no trace > wipes memory This incorrect. Such system write over data. Trace on *all* flash. Can be recovered. Read hacks.

3 2