- cypherpunks - lists.cpunks.org

telesnowden selected excerpts
by coderman 19 Mar '14

19 Mar '14

a few things i found interesting, per http://blog.inside.com/blog/2014/3/10/edward-snowden-sxsw-full-transcriptio… (better script and transcode?) --- emphasis on attacks against crypto systems by targeting the random number generator(s): "typically it is the random number generators that are attacked as opposed to the encryption algorithms" "... encryption does work.... a basic protection[,] it is a defense against the dark arts for the digital realm. This is something we all need to be not only implementing but actively researching and improving on an academic level. The grad students of today and tomorrow need to keep today's threat on online to inform tomorrows. We need all those brilliant Belgian cryptographers to go alright we know that these encryption algorithms we are using today work typically it is the random number generators that are attacked as opposed to the encryption algorithms themselves. How can we make them ____ how can we test them? This is _____ it is not going to go away tomorrow, but it is the steps we take today. The moral commitment. The philosophical commitment, the commercial commitment to protect and enforce our liberties through technical standards to allow us to reclaim the open and trusted." --- "By doing end to end encryption you force what they are called ... global passive adversaries to go for the end points that is the... computers. And the result of that is a constitutional, more carefully overseeing sort of intelligence gathering model. Where if they want to gather somebody's communications they have to target them specifically. They can't just target everybody all the time and then when they want to read your stuff they go back in a time machine and say what did they say you know in 2006. They can't pitch exploits in every computer in the world without getting caught. That is the value of end to end encryption and that is what we need to be thinking about." the targeted attacks under a different authorization and more restrict controls? would like details on "constraints" and "authorizations" and specific projectnames. :) ---- "The NSA the sort of global mass surveillance that is occurring in all of these countries. Not just the US it is important to remember that this is a global issue. They are setting fire to the future of the internet." this is a global problem. somehow, with decades of growth nurtured and shaped and guided along flawed trajectories, we looked around and found everyone and everything bathed in surveillance and privacy invasion, myriad motives across state/corporate/professional boundaries coopted in blissful or willful ignorance as was chosen. --- "Let me embrace thee, sour adversity, for wise men say it is the wisest course." - William Shakespeare

1 0

cyberwarfare by lawyers
by Cari Machet 19 Mar '14

19 Mar '14

'The Jerusalem Post recently interviewed Col. Sharon Afek, formerly deputy head of the IDF's legal division, who wrote a 149-page treatise on cyber warfare law - the first treatise of that comprehensiveness by a military lawyer of his rank and stature.' http://www.jpost.com/Defense/Analysis-How-Israel-is-dealing-with-cyber-warf… 'Many are also asking more strongly than ever: "Is international law still relevant?" Afek, who views his treatise also as a "bridge" between the pre- and post-cyber world of war, answers with a resounding "yes," but then goes further to try to resolve some of the questions of how and where it applies. One debate in the new wild west of cyberwarfare law is between two schools of thought about where to draw the line of which cyber operations should be declared illegal under international law.' http://www.jpost.com/Features/Front-Lines/A-revolution-in-war-339962 -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

7 9

Re: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi
by Aaron Zauner 19 Mar '14

19 Mar '14

cates From Trust, Stores References: <5328EE7F.9070503(a)azet.org> <5328F7FC.5060802(a)iang.org> In-Reply-To: <5328F7FC.5060802(a)iang.org> X-Enigmail-Version: 1.2.3 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig2D2852BFD85FEBF952C9CE4C" Cc: cpunks <cypherpunks(a)cpunks.org> X-BeenThere: cypherpunks(a)cpunks.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: The Cypherpunks Mailing List <cypherpunks.cpunks.org> List-Unsubscribe: <https://cpunks.org/mailman/options/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=unsubscribe> List-Archive: <http://cpunks.org/pipermail/cypherpunks/> List-Post: <mailto:cypherpunks@cpunks.org> List-Help: <mailto:cypherpunks-request@cpunks.org?subject=help> List-Subscribe: <https://cpunks.org/mailman/listinfo/cypherpunks>, <mailto:cypherpunks-request@cpunks.org?subject=subscribe> X-List-Received-Date: Wed, 19 Mar 2014 03:52:41 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Ian, ianG wrote: > Nice! Now, if they could package up a plugin or a new root list such > that we could write in 2 lines what busy sysadms had to do, I'd say it > would make a great recommendation. >=20 > What I'm trying to get away from is the notion that we should put a > simply list in the doc and say "oh, and strip these out! You know > how, vi is your friend..." Yea. That won't work at all, there's no clear authority [sic!] on who can decide a CA is not trustworthy. Experience has to show that, and in that case a lot of the big CAs will fail an evaluation. If you ask me, it's pretty easy, my list of trusted CAs is empty. Automated generation of lists of CAs that are simply unused is just the first step. I think certificate-transparency is a good way to do that, the rest is basically automation. For example: one can provide chef, puppet, ansible recipies for linux and mac clients, a similar solution for windows and mobile devices should also be doable. Aaron --------------enig2D2852BFD85FEBF952C9CE4C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJTKRQqAAoJEOTbZJL9ubXVB2cQAMCC6nlPTgUn86bCXi8ny+uk noYKI7XXHq0Hzl/f3Hd67oAXEX9wNh1znSBRYJ3sfSd5dgeyTfhn6NIITjdzqGc1 +1yAmyIn7Q8/+lDgSEPdsTDKFXqiTtQj9iK6t+/Ul6/l34movetvYBBI85f9yO96 4swk7obaqpRqkziVoUt0K2lopYrCxXHK7hVkXmwXgt1UlyccODHy2fWO3QWl8SWw xmrQlCJ+BGuYiV2mNFZe9w5etLwGX7wiR4xpaAHXoYZL6Kt2f//fmdb+pWnq8lE/ /NxmAQlDboPBB39uPhhsUtbrwOUS/4ZFqiA3tUSgcYZMGxYPWoUkkJpuccpWhYMf psaWrZmhz0CoL9FPiKngscv9DNAMIHfOOa0Ynku4RfBvO2Q/4F1JrW4epwCJuQiK kxKDjD2+pQ/UdIlIWSdylskaVZV+qsKWBa+4oBbGQYz9DXLgYwaPh7p6QzRcZGvA sP3p6t+aluUqCtc11cgiKfCfLs8uezTNQUYrrlu4E1G3IXkMPMmSOuheiwu+sRCJ BSlP/ys/FihB6J6EsC4i7AkLK8Ws1vfarCZDdycA++lr63Uoj0LEYv8/nTgg/GNj ZaDmuGO1sBMwEEH0nTyBDk2fJryOFjiGzzdzmEuk7fAWD6tY16mqYUptqlDmphz/ 79u6Uftx8nNa3u099JBL =7ty+ -----END PGP SIGNATURE----- --------------enig2D2852BFD85FEBF952C9CE4C--

2 1

Special Source Operations puzzles
by coderman 19 Mar '14

19 Mar '14

in the SSO overview slide there are three colors: https://peertech.org/files/sso-in-mah-tubes.jpg --- i fancy them as follows: GREEN: legally compelled and gagged plaintext access through service providers, like BLARNEY and PRISM RED: financially motivated secret agreement with "special partners" for filthy lucre. e.g. GTE fiber access. BLUE: unilateral / non-cooperative operations; covert black bag taps. --- if most facilities, like room 641A, are in RED zones, then recent ground breaking improvements in BLUE may be miniaturized and covert taps with selectors and large local cache. alternatively, new capability could be upgrades to the RED facilities where BLUE traffic is conveniently co-processed, cached, and UPSTREAM'ed. paging Top Level Telecom, ;)

1 0

Fwd: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi cates From Trust, Stores
by coderman 19 Mar '14

19 Mar '14

Fwd^2: ---------- Forwarded message ---------- From: Aaron Zauner ... Date: Tue, Mar 18, 2014 at 6:10 PM Subject: [Ach] You Won't Be Needing These Any More:, On Removing Unused Certi cates From Trust, Stores Recommended reading: https://www2.dcsec.uni-hannover.de/files/fc14_unused_cas.pdf (PDF copypasta with missing characters following): ``` 6 Conclusion In this paper we argued for the removal of CA certi cates that do not sign any certi cates used in HTTPS connections from desktop and browser trust stores. We based our analysis on an Internet-wide dataset of 48 million HTTPS certi cates and compared them to trust stores from all major browser and OS vendors. We were able to identify 140 CA certi cates included in twelve trust stores from all major platforms that are never used for signing certi cates used in HTTPS. Based on these ndings, we suggest to remove or restrict these CA certi cates. Using two months' worth of TLS handshake data from our university network, we con rmed that removing these certi cates from users' trust stores would not result in a single HTTPS warning message. Thus, this action provides a simple and low-cost real-world improvement that users can implement right now to make their HTTPS connections more secure. We are working on creating tools and scripts to automate this process for diﬀerent browsers and operating systems. Our current list of CAs we recommend for removal is a conservative one. It includes all CAs that have never signed a HTTPS certi cate. In future work,we would like to analyze the trade-oﬀ between false positives and the size of the trust store, as well as look into mechanisms to restrict the capabilities of certi cates on the Android platform. ``` Aaron _______________________________________________ Ach mailing list Ach(a)lists.cert.at http://lists.cert.at/cgi-bin/mailman/listinfo/ach

1 0

Blade Runner Mesh Networking
by Griffin Boyce 18 Mar '14

18 Mar '14

So if (spoiler) Deckard's a replicant, and he knows about Rachel's implanted memories right after meeting her, and Gaff knows about Deckard's unicorn dream right after it happens... Does that mean that the replicants are all meshing? ~Griffin

1 0

a prediction market denominated in Bitcoin
by dan＠geer.org 17 Mar '14

17 Mar '14

http://www.siliconrepublic.com/start-ups/item/33411-irish-start-up-launches/ https://www.predictious.com/ Onward, --dan

1 0

Re: Journalists Shill Sources and Secrets
by John Young 17 Mar '14

17 Mar '14

At 09:25 PM 3/16/2014, Cari Machet wrote: wait ... are you saying money corrupts ??? if you are saying that corruption is at hand then how can we trust the supposed human beings behind any of these names ? i mean i think you are saying corruption is at hand but i dont want to assume anything... Assume this promotional creed screed for national security journalism: http://cryptome.org/2014/03/sources-and-secrets-brief.pdf No, media venality is not news. What is worth examining is the long-term exploitation of "national security" as a joint gov-com-edu-org racket to manipulate secretkeeping as a wealth concentration industry. This has been commonplace since the national security state was invented after WW2 and led to need for continuous spying to manufacture enemies and to arm for diddly squat combat against fictious foes by hugely expensive but hardly ever used armaments. Cryptosystems among the black budgetary wastage. In particular cryptosystem popularization (as here and its emulators) as ostensible opposition to the national security racket, begun in the flower-child 60s to flower wildly in the 90s and rise to a kudzu crescendo with Snowden's operation to validate crypto use against illusory enemies within the state, cloaked as usual by the blanket exculpt "to do no harm to national security," then hide behind privileged natsec journalism so dirty and complicit in govenment affairs it needs protection from the public, so merely dribbles dainty tidbits of threats to privacy and to advance the favorite ACLU and EFF lawyerly fund-raising hobgobblin of constitutional violation. FISA Court jiggery-pokery by lawfare warriors indicates that lawyers and judges know diddly about comsec technology but dare not admit it and lose control of the public narrative of threat and protection obligatory in the trillion dollar national security hootenany which compares to organized religion of the medieval era which ruled heaven and earth with fantasticly frightening and pleasuring tales of evil and salvation. Adled journalists are racing to adopt encryption as crusading chain mail raiment, ignorant of how easily it can be penetrated, but no matter, what will really protect the valiant journalists is "constitutional protection," a comedy of conceit and stupidity usually associated with court jesters.

1 0

Comsec as Public Utility Beyond Illusory Privacy
by John Young 17 Mar '14

17 Mar '14

Snowden may have raised the prospect of comsec as a public utility like power, water, gas, sewage, air quality, environmental protection and telecommunications. Privacy protection has been shown to be illusory at best, deceptive at worst, due to the uncontrollable technology applied erroneously for national security. Each of the other public utilities began as private offerings before becoming commercialized and then institutionalized as necessities, many eventually near or wholly monopolies. Each also evolved into military targets for control, contamination, destruction, and in some cases excluded as too essential for civilian livelihood to target. Comsec as a right for human discourse rather than a commercial service could enforce privacy beyond easy violation for official and commercial purposes. Freedom of comsec, say, as a new entry in the US Bill of Rights could lead the way for it to be a fundamental element of Human Rights. The problem will be as ever the commercial and governmental exploiters aiming to protect their interests against that of the public. FCC and NIST, indeed, the three branches, are hardly reliable to pursue this, so beholden to the spy agencies they cannot be trusted. NSA's ubiquitous spying on everybody at home and elsewhere with technology beyond accountability does raise the chances of getting agreement of all targets -- gov, com, edu, org -- to say enough is enough, national security has become a catchall for inexcusable invasion of the public realm.

4 7

Journalists Shill Sources and Secrets
by John Young 17 Mar '14

17 Mar '14

Journalists Shill Sources and Secrets http://sourcesandsecrets.com/ Advertised with $20,000 full-page vanity ad in the New York Times, 16 March 2014. Coordinated with the NYT's release of its Snowden files series and books by Greenwald and Gellman, and video by Poitras, as well as capacious media roll-outs, conferences, celebrity profiles, movies, awards, prizes, law suits, mock threats, and phony investigations. Also coordinated with the rise of billionaire and corporate-funded "non-profit" journalism like ProPublica, The Intercept and The Marshall Project which pay over $500,000 top salaries, some with over $1M in total compensation packages. http://cryptome.org/2014/03/npj-14-0314.pdf See dozens of conference sponsors of commercial journalism at bottom. This conference is full. Registration is now closed for this event. Sources + Secrets A Conference on the Press, the Government and National Security Friday, March 21, 2014 at 8:00AM at The TimesCenter 242 West 41st Street New York, NY 10018 Focusing on the divide between the government and the press over coverage of national security issues, the Sources + Secrets Conference will examine the legal basis and scope of government actions that have hampered the work of journalists and offer administration representatives an opportunity to present their case for secrecy. Agenda THE LONG ARM OF THE LAW: panel on the Espionage Act, recent court decisions and Justice Department guidelines on subpoenas to reporters Ben Wizner, A.C.L.U.; David A. Schulz, First Amendment litigator; Laura R. Handman, First Amendment litigator; Jeffrey Toobin, The New Yorker. Moderator: Adam Liptak, The New York Times PERILS OF COVERING NATIONAL SECURITY: panel on the impact of government actions on confidential sources and reporting techniques Jane Mayer, The New Yorker; Mark Mazzetti, The New York Times; Peter Maass, writer; and Robert L. Deitz, former general counsel, N.S.A. and senior councillor to the C.I.A. director. Moderator: Bob Woodward, The Washington Post THE SNOWDEN REVELATIONS: Roger Cohen, The New York Times, interviews Glenn Greenwald, The Guardian; Laura Poitras, The New York Times; and Barton Gellman, The Washington Post, via Skype PROSPECTS FOR A FEDERAL SHIELD LAW: discussion of the proposed Free Flow of Information Act Bill Keller, editor in chief, The Marshall Project, interviews Senator Charles Schumer, followed by panel with Senator Schumer; Quinn Norton, freelance journalist, activist; Jonathan Landay, McClatchy; Scott Horton, reporter, Harper's Magazine; and Kenneth L. Wainstein, former assistant attorney general for national security and homeland security advisor WHERE DO WE GO FROM HERE? Panel discussion on achieving a balance between press freedom and national security Jill Abramson, executive editor, The New York Times; Martin Baron, executive editor, The Washington Post; David Remnick, editor, The New Yorker; Katrina vanden Heuvel, editor and publisher, The Nation; Robert S. Litt, General Counsel, Office of the Director of National Intelligence. Moderator: Ken Auletta, The New Yorker SUPPORTED BY ABC News; The Annenberg Center on Communication, Leadership & Policy; The Arthur L. Carter Journalism Institute at New York University; The Associated Press; CBS; The Center for Communication; the Center for Investigative Reporting; The Center for Public Integrity; CNN; Columbia Graduate School of Journalism; The Committee to Protect Journalists; The Denver Post; Frontline; The Hearst Corporation; The Huffington Post; Investigative Reporters and Editors; The Shorenstein Center on Media, Politics and Public Policy; The Los Angeles Times; The McClatchy Company; the Medill National Security Journalism Initiative; The Milwaukee Journal Sentinel; The New York Review of Books; The New Yorker; the Newspaper Association of America; The Nieman Foundation; NOLA.com/The Times-Picayune; PEN American Center; The Philip Merrill College of Journalism; The Poynter Institute; ProPublica; The Record and Herald News of North Jersey; the Reporters Committee for Freedom of the Press; Reporters Without Borders; Reuters; UC Berkeley Graduate School of Journalism; The Wall Street Journal and The Washington Post.

2 1