- cypherpunks - lists.cpunks.org

Re: [p2p-hackers] The next gen P2P secure email solution
by grarpamp 02 Feb '14

02 Feb '14

On Fri, Jan 31, 2014 at 11:39 PM, Bill Broadley <bill(a)broadley.org> wrote: > On 01/30/2014 08:51 PM, grarpamp wrote: >> Other than for latency issues in our protocols, there's enough >> fiber to generally ignore our global traffic impact... torrent, video >> and cloud are dominating that, not messaging anymore. > > Indeed. Even the "3rd world" of home internet connections the USA > (ranked 14th) has an average speed of 7mbit/sec. Any reasonable > multiple of Email/IM traffic is basically zero. Not particularly worth > discussing. > > The hardest part of the problem is the feature set and social aspect of > launching a new messaging network. Clearly it's still happening with > Mxit, WhatsApp, WeChat, Line, Viber, MessageMe, Voxer, etc. > > I think WhisperPush's approach with TextSecure is interesting: > * they partnered with cyanogen to because the default on a substantial > number of phones > * It "just works" with any SMS user, granted no security/encryption > * It "just works" securely with any other TextSecure user > * It also "just works" on IOS, granted a user has to track it down > and install it. Why these 'social launches' work for crappy apps is becuase the windows writers cater to and know the forum using, bling ridden, pop, idiot-sphere. While cpunk writers / good apps such as might be found below have historically shied away from that catering/knowing, there is no reason they cannot engage it, or that they cannot partner with people that do to enable their own social launch. https://prism-break.org/ > As far as I know Cyanogen does not have a secure IM app yet. > >>On Sun, Jan 12, 2014 at 3:29 PM, Christian Huitema >>> I believe this is actually an issue. The number of pings per host scales as >>> O(log N), which means the amount of maintenance traffic scales as O(N log N) >>> -- more than linearly with the size of the network. Given the nature of the >>> DHT, the addresses to be pinged > > So yes, per node bandwidth scales with O(log N). System bandwidth with > O(N log N). But it's so small that it's mostly irrelevant. Sure some > phone users will be power limited or have a very low data cap, in those > cases they should install a raspberry pi at home or share a node with > more resources. > > Don't worry about 2 billion users before you get 2000. I don't agree. If you do not design for say 2bn users upfront (as is the general subject of this thread re: nexgen global p2p solutions) and instead target 200k or less, you will hit major roadblocks that are very difficult to rip out and cure becuase your entire mindset from day one was only scaling to a dreamy 200k. Mindset and failure to think big traps projects like these, and if they somehow capture and grow users they'll get overloaded to the point of unusability. The best case they then embarrasingly have is to take a year basically rewriting from scratch, or they fail and users move on. And once a project hits unusability issues, that is a hard image to shake... fool me once. This is a classic issue in systems history, where better upfront design would have prevented it. The examples are plenty, there's really no excuse anymore. >> I think the question is, can we do what we want to do within >> the bandwidth that our target users have available to them... >> such as say a 56k channel, 128k, 512k, etc. If we're using >> 32 of 56k for maintenance, that may leave little left for the >> signal you want to send through. > > 10M users DHTs work today with minimal bandwidth overhead (kbit/sec) > while maintaining MByte/sec (factor of 8000 different). The huge > majority of node bandwidth goes to actually downloading torrents. > > So basically I don't see any particularly big technical hurdles. Not > that there aren't others. The network effect and social issues being > the big ones. > > ChatSecure looks pretty reasonable. In a perfect world I'd hope for a > client that: > * fully decentralized, only has find the bit-torrent mainline DHT to > be able to find peers. Why not use the existing 10M peers to help > find compatible peers. > * IPv6 capable, clearly the easiest way to directly connect other peers > in the future. Comcast is already over 25% and IPv6 seems to be > gathering steam. > * Simple tit-for-tat bandwidth and storage trading between owners. > Reputation based on direct observation (no 3rd parties). > * support for 2 tiers of peers, those with long connection times > bandwidth and power to burn and those with intermittent connections > and are power/bandwidth limited. > * allowing people to have a home node that trades bandwidth/storage > with peers and then a mobile node with the same crypto identify > that can leverage the home node and any of it's peers. > > Ideally I could have a 2TB disk ($100) at hosting my more important > files (200GB) and earning the good will of it's peers by hosting > encrypted blobs for them. Leave it connected to a raspberry pi/beagle > board black for $40. Then as needed I can use the goodwill of those > peers to record for whatever bandwidth/storage needs I have. > > So basically my node and it's friends could act collectively as my > IM/Mail/File server. The p2p pooled anon secure model is interesting. I think MaidSecure was the most recent thing making the rounds in this area. Maybe FreeNet is also similar. > _______________________________________________ > p2p-hackers mailing list > p2p-hackers(a)lists.zooko.com > http://lists.zooko.com/mailman/listinfo/p2p-hackers

1 0

Re: [Cryptography] The crypto behind the blackphone
by grarpamp 02 Feb '14

02 Feb '14

On Mon, Jan 27, 2014 at 4:10 PM, Jon Callas <jon(a)callas.org> wrote: > My truest personal goal for Blackphone is read an Android hardening guide sometime in the future that will give a list of the things you should do to lock down your Android phone, and at the end it will say, "Or you could just buy a Blackphone." I want it to come out of the box the way that serious people like us on this list would want it. > It will also have a set of software and services that people like us would like to have, which is part of the hardening, in my opinion. How would this be any different than what the guardian (and other phone SW projects) are developing, other than shipment of a phone preloaded with your flavor of Android OS? (And perhaps also offering IMEI/SIM cell service?) As opposed to the user flashing Android-ROM-OS into any compatible phone and choosing their service. Thus, save that convenience, why? This question shouldn't imply such products aren't needed. Note some open phone HW projects are selling hardware to which you apply your droid SW rom. Though we're likely at least a handful of years away from seeing a genuinely 'open design' baseband HW layer in a phone, they are talking about approaching it.

2 3

our drone future
by gwen hastings 02 Feb '14

02 Feb '14

for those that have not seen this... http://www.youtube.com/watch?v=CgLkWT246qU -- Tentacle #99 ecc public key curve p25519(pcp 0.15) 1l0$WoM5C8z=yeZG7?$]f^Uu8.g>4rf#t^6mfW9(rr910 Governments are instituted among men, deriving their just powers from the consent of the governed, that whenever any form of government becomes destructive of these ends, it is the right of the people to alter or abolish it, and to institute new government, laying its foundation on such principles, and organizing its powers in such form, as to them shall seem most likely to effect their safety and happiness.’ https://github.com/TLINDEN/pcp.git to get pcp(curve25519 cli) https://github.com/stef/pbp.git (curve 25519 python based cli)

3 2

Fw: Jim Bell's Email crash
by jim bell 31 Jan '14

31 Jan '14

My email provider, the idiots at Yahoo.com, crashed my email address account 'jamesdbell8(a)yahoo.com' last Sunday. I have lost my email addresses, as well as all emails. For now, I will have to operate on a new email address, 'jamesdbell9(a)yahoo.com'. At this point, Yahoo is my #1 enemy, and I expect them to be "The first against the wall when the revolution comes". Jim Bell

11 13

{}coin: good enough for election politics?
by Troy Benjegerdes 31 Jan '14

31 Jan '14

I may be a fool, but I'm not fool enough to play with Assassination politcs. I am, however, stupid enough to go do something provacative like attempt to prove that code is speech, money is code, and someone better figure out a better way to deal with campaign finance or we are all screwed. So I present {}coin, the broken cryptocurrency, neutered of all the privacy I can strip out of it, for broken election systems. https://bitbucket.org/dahozer/-- Could a good anonoperson cipherpunk tack on higher-level layers that are actually anonymous, as opposed too what I see being proposed for Bitcoin? Probably. >From the techno-political-economic angle, it looks like overlaying distributed high-frequency futures trading would provide more than enough noise on top of fully-surveillable {}coin to provide a sufficient anonymity set, while actually providing a usefull value to us farmers, who could actually see who's on the other side of a trade. The experts at stealth, redirection, misdirection, and over-all dirty tricks (aka Wall Street) could simply move up a few layers and continue their anonymous game-of-thrones ( I mean game of CEO), and hide in plain sight in huge volumes of trades, and then so could anyone else. But then **I** don't have to pay to be someone else's anonymity set, and I could make money if I wanted to play that game, and take money from those who want to hide, instead of having value siphoned off by thousands of economic vampires hiding under regulatory capture of our current finance system. Does this sound anywhere near possible, or am I just an optimistic hashcash fool?

12 35

NSA Redactions Fail, Fail and Fail Again
by John Young 30 Jan '14

30 Jan '14

Humorous Snowden media inept infosec redactions: NSA Redactions Fail, Fail and Fail Again: http://cryptome.org/2014/01/nsa-redaction-fails.pdf

2 1

MaidSafe: p2p encrypted anonymous drivesharing homedir network?
by grarpamp 30 Jan '14

30 Jan '14

Lots of unknown popups making bold claims lately that should be looked into... discuss? ---------- Forwarded message ---------- From: David Irvine <david.irvine(a)maidsafe.net> Date: Sun, Jan 26, 2014 at 10:51 AM Subject: [bitcoin-list] Meeting place to discuss 'the decentralised internet' projects To: bitcoin-list(a)lists.sourceforge.net Hi sorry for barging in, but with all of the projects now based around decentralisation, I thought a common place to exchange ideas would be good. I have created a subreddit http://www.reddit.com/r/decentralisedinternet as a place for as many projects to collaborate and share experiences, research and general comments. I am hoping to make this an open environment for discussion and technical debate, but not a place of project wars. This is essential and to that end I would like to engage with you and have you all sign up to the subreddit. I believe as we recodnise more projects then at least one person from each project should be a moderator. This should add stability and ensure that each project is protected as they all have their own path to follow. I suggest each project puts forward an admin and I will add them immediately. I believe there is enough of a push now to decentralise services and working together to achieve all of our goals can only be a good thing. Below is the sidebar text as it stands, this is all open for debate. ######################## This is a reddit of logic and not emotion, please base all debate on logic. We do not want project wars here, so no vim/emacs type debate between projects. Keep focussed and logical if at all possible. Whilst people will prefer one project over another, the point of this subreddit is to find the technically best solutions to the miriad of issues and share technology and discussion between projects. Advertising is not a goal of this subreddit, although new information about projects is encouraged. Submissions that are mostly about some other server based solutions belong elsewhere. Please avoid repetition — /r/decentralisedinternet is a subreddit devoted to new information and discussion about decentralisation of the Internet. New projects are welcome to announce themselves via this reddit, but after those have been announced they are no longer news and should not be re-posted. New news will be accepted. Aside from new project announcements, those interested in advertising to our audience should consider Reddit's self-serve advertising system. Projects so far (please request to be added by posting a link to your project, if it is upvoted and agreed by redditors to be accepted it will be added here) Freenet Tahoe bitcoin MaidSafe bitcloud twister ########################## I am sending this message to each of the projects mentioned and any others that should be included as we progress. -- David Irvine maidsafe.net <http://www.maidsafe.net/> twitter: @metaquestions blog: http://metaquestions.me ------------------------------------------------------------------------------ CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing CenturyLink Cloud For Critical Workloads, Development Environments & Everything In Between. Get a Quote or Start a Free Trial Today. http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk _______________________________________________ bitcoin-list mailing list bitcoin-list(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-list

2 1

facial mesh tracking and subsitution
by gwen hastings 30 Jan '14

30 Jan '14

https://github.com/auduno/clmtrackr -- Tentacle #99 ecc public key curve p25519(pcp 0.15) 1l0$WoM5C8z=yeZG7?$]f^Uu8.g>4rf#t^6mfW9(rr910 Governments are instituted among men, deriving their just powers from the consent of the governed, that whenever any form of government becomes destructive of these ends, it is the right of the people to alter or abolish it, and to institute new government, laying its foundation on such principles, and organizing its powers in such form, as to them shall seem most likely to effect their safety and happiness.’ https://github.com/TLINDEN/pcp.git to get pcp(curve25519 cli) https://github.com/stef/pbp.git (curve 25519 python based cli)

1 0

Fwd: [Dailydave] Understanding BIOS & SMM
by coderman 29 Jan '14

29 Jan '14

---------- Forwarded message ---------- From: Xeno Kovah <xsk.dailydave(a)gmail.com> Date: Sun, Jan 26, 2014 at 7:45 AM Subject: [Dailydave] Understanding BIOS & SMM Our research team at MITRE has been looking into BIOS security for the past couple years and starting to publish our results in the last year. We described BIOS exploits and an in-BIOS defensive system called BIOS Chronomancy at venues like BlackHat and ACM CCS. We also released a free tool called Copernicus[1] which lets you detect if a BIOS is writable, and dump the contents of the BIOS from a Windows system (which makes enterprise-wide configuration and integrity checking possible.) But the question is, let's say you have a BIOS dump and it shows differences. How are you going to interpret those differences? How do you distinguish natural changes from malicious ones? We wanted to get a basic inspection capability out there, but we recognized that people were going to need to know a lot more about system internals, hardware quirks, and UEFI before they'd be able to make full use of it. So we made a class to help bootstrap people faster. Currently the class is scheduled for CanSecWest[2] and Syscan[3] (and the prices are going up starting Feb 1). It would be nice if people wanted to understand how the deep system architecture worked for it's own sake, because we of course think it's super interesting and fulfilling to know things others don't. But hopefully the news of the past couple months has made people realize that "out of sight, out of mind" isn't a great strategy for BIOS security. First there was #badBIOS (which was kicked off by Dragos experimenting with Copernicus[4]). Then there was NSA's defensive side saying they had caught the Chinese making BIOS bricking attacks[5]. Then there was NSA's offensive side being caught having their own BIOS backdoor capabilities[6]. And of course there were a whole lot of people letting their FUD flags fly around all of it. So if you'd like to get a more technical and quantitative view of what the BIOS/SMM security landscape looks like, you should check out our classes and watch for talks by Corey Kallenberg, John Butterworth, and myself over the next 6 months where we'll be describing 2 new BIOS memory-corruption-to-reflash exploits, 2 new SecureBoot-breaking tricks, and trustworthy computing extensions to Copernicus that will counter many classes of attacks against BIOS dumping software that would let an attacker hide his BIOS presence. Xeno [1]http://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-bl… [2]https://cansecwest.com/dojo.html [3]http://syscan.org/index.php/sg/training [4]https://plus.google.com/103470457057356043365/posts/exuXRz5C3L3 [5]http://www.cbsnews.com/news/nsa-speaks-out-on-snowden-spying/ [6]http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html

2 1

Re: Al-qaeda.net deprecated (was: Note to new-ish subscribers)
by Bill Stewart 28 Jan '14

28 Jan '14

At 03:38 PM 1/19/2014, Shawn K. Quinn wrote: >On Sun, Jan 19, 2014, at 02:45 PM, John Young wrote: > > What happened to cypherpunks.org? Who owns it? It's > > registration is hidden behind GoDaddy. Listed Servers: > > > > Name Server:NS.CYPHERPUNKS.TO > > Name Server:ASTERIA.DEBIAN.OR.AT > > > > http://www.cypherpunks.to/ list familiar > > people. >The "webmaster" mailbox at the domain appears to work, so maybe just >asking them will give you useful info. Cypherpunks.to is Lucky Green and friends; looks like it's based at/near xs4all.nl.

6 16