- cypherpunks - lists.cpunks.org

An important text for understanding the project of the Empire of Chaos
by Zenaan Harkness 21 Jul '16

21 Jul '16

“Our real enemy is our greatest ally. The ultimate proof” [by Maurizio Blondet] ~ An important short text to understand the project of the Empire of Chaos https://syrianfreepress.wordpress.com/2015/06/23/enemy-ally-blondet/ Here's a small version of linked video (1GiB otherwise): youtube-dl -f 249+242 http://www.youtube.com/watch?v=QeLu_yyz3tc

3 3

Fwd: Call for input to President's Commission on Enhancing Cybersecurity - bridging the trust gap between the IT community and the US government
by Joy 21 Jul '16

21 Jul '16

- - - Begin forwarded message - - - Date: July 15, 2016 at 3:21:32 PM EDT From: Herb Lin <herblin(a)stanford.edu> To: "'David Farber (dave(a)farber.net)'" <dave(a)farber.net>, ip <ip(a)listbox.com> Subject: Call for input to President's Commission on Enhancing Cybersecurity - bridging the trust gap between the IT community and the US government Dear IPers - You may know that President Obama has established a commission to consider how to strengthen cybersecurity in both the public and private sectors while protecting privacy, ensuring public safety and economic and national security, fostering discovery and development of new technical solutions, and bolstering partnerships between Federal, State, and local government and the private sector in the development, promotion, and use of cybersecurity technologies, policies, and best practices. (See https://www.whitehouse.gov/the-press-office/2016/02/09/executive-order-comm….) I am one of the 12 designated commissioners. Recognizing that trust is hard to build and easy to destroy (and a variety of things have happened over the last 20 years have occurred to do the latter), one issue that has come up is the enormous gap of trust between the U.S. government and the information technology (IT) community, from which many IPers are drawn. This rift is not helpful to either side, and I'd like to solicit input from the IP community about what you think the government can do or refrain from doing to help bridge that gap. It would be most helpful if you could three things in your response: 1 - Your best examples of things the government (and what part of the US government) has done to alienate the IT community specifically. (Or, at the very least, show how the examples you provide connect to the interests of the IT community.) 2 - Things that the U.S. government could realistically do in the short and medium term (i.e., 0-10 year time frame) that would help bridge the trust gap. If your answer is "Don't do dumb things!", it would be better and more useful to provide *examples* of what not to do. 3 - Things that the U.S. government could realistically do in the longer term to do the same. Please send your responses to CENCinput1(a)gmail.com. (I set up this email address, but I'd like to keep the traffic separate from my non-Commission work email.) I promise to read as many as I can individually and share what I learn with the commission membership. Also, feel free to circulate this call for input to anyone else you feel would want to comment. Thanks much Herb ======================================================================= Herb Lin Senior Research Scholar, Center for International Security and Cooperation Research Fellow, Hoover Institution Stanford University Stanford, CA 94305 USA herblin(a)stanford.edu 650-497-8600 office || 202-841-0525 cell || 202-540-9878 fax AIM herblin (any time you see me) Skype herbert_lin (usually by appointment) Twitter @HerbLinCyber This message was sent to the list address and trashed, but can be found online. - - - End forwarded message - - -

9 19

#Jakegate Becomes #Torgate [re: Tor Replaces Its Entire Board]
by grarpamp 20 Jul '16

20 Jul '16

https://twitter.com/wikileaks/status/755019531228250112 "Tor operator @LuckyGreen resigns; a collection of leaks (for/against) on the @TorProject 'rape+plagiarism+CIA' saga https://www.oneeyedman.net/?p=2508 Since things seem to be falling apart at the Tor Project, and also in the campaign against Jacob Appelbaum (@ioerror), I’m beginning a list (for my own convenience) of leaked documents.."

1 0

Re: [tor-talk] FBI cracked Tor security
by Mirimir 20 Jul '16

20 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/19/2016 12:02 AM, grarpamp wrote: > On 7/18/16, Mirimir <mirimir(a)riseup.net> wrote: >> Anyway, what does Tor Project gain by not mentioning Whonix? > > That's a bit sideways, but in the interest of sideways eventually > moving forward... I'd say "meta" rather than "sideways", but hey ;) > 1) Funding of sorts, which spreads around, to develop TBB, a > sizable prioject, to do decent things a browser should do, > hopefully feeding back to Mozilla. Were certain elements of > security left uninvestigated and just punted to Whonix+FF, well > that's a incomplete partial approach too. If you want funds, you > might not want to publish other partial solutions. Well, Whonix uses stock Tor browser, with a tweak to keep it from launching its own local tor process. It also enforces stream separation for other apps. But the key thing here is that it prevents proxy bypass. > Securing the browser and browser meta is a fine project. And as has > been said, it's still needed to pair the app with defense in depth > and a known line around application land. Just remember TBB and Tor > are not and cannot be that line. Yes, they are for sure not that line. So why not acknowledge that? Maybe key funders have said no to that. > 2) Captured audience dependency. As with publishing, this is > corporate 101. Giving someone an app is well... welcome to apps, > and a torbox to run them on. Like iTunes on iPhone. Right. For most, Tor browser on Windows. Pwnage waiting to happen. But why does Tor Project care about captured audience dependency? People using Whonix, like people using Tails, are still using Tor. And still using stock Tor browser. Maybe goals of key funders are driving this. Deliver lots of Tor relays and users to hide our agents. But make sure that users can't hide from our TLAs. That's what language in Graham's appropriations bill says. Maybe that's been the backroom deal for years, and Tor Project has been pushing back. One does get that sense from the leaked IRC logs. > Giving someone unix is like airdropping a great big box of freedom > their way. Here, have some free beer... > > https://www.freebsd.org/ https://www.openbsd.org/ > https://torbsd.github.io/ > > Or whatever it is penquins drink... https://www.whonix.org/ > https://www.whonix.org/wiki/Qubes https://www.qubes-os.org/ > > Or a fine Javanese app... https://geti2p.net/ > > 3) Like I said, the real reason is probably a bit more mundane... > nobody signed on to update the content. Tor has money, go hire > yourself. I doubt that they hire anons :( But damn, I'd do it for free, if they let me :) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXjdcZAAoJEGINZVEXwuQ+G24IAKZTOZVxidiX2qEnOokfKh1T pg8BsXRgyMx7395mMc3WDFx16zc1Ylbh14z+YUq+1TOenO2wURjtTT9OCjCAjnOI IL1GRXjM23QLTI0qkRCwiEB04HZsu5t1jq1sJ7F23BUX/UjSBuK1osmtK3Ve3ucb qMTgZVIgmnWwdFkEM1l5fcDltnIYzOxF5VR0jHo5KTQ63l7E/xcNaWD/Y92yUu5C ZLeCYgVc+KdngHhVPDzhphCeWXwrVdpwRO0zqqLiR8ijn/dW0fFA7gOfZzTI1YTw VmVymrDWBfr6RjZ0FVeSIrvhewVRPjHIepTHwOuQQsAde5UGhtNv9lnXt+P7Rq4= =w5Ab -----END PGP SIGNATURE-----

2 1

Lucky Green Quits Tor Hard [re: Tor Replaces Its Entire Board]
by grarpamp 19 Jul '16

19 Jul '16

https://trac.torproject.org/projects/tor/ticket/19690 http://archive.is/T8Hlu (Uncensored version) http://forums.theregister.co.uk/forum/1/2016/07/18/lucky_green_torpedos_tor… https://www.reddit.com/r/privacy/comments/4tectj/tor_veteran_lucky_green_ex… """"" Tonga (Bridge Authority) Permanent Shutdown Notice 2016-07-16T01:06:25Z Dear friends, Given recent events, it is no longer appropriate for me to materially contribute to the Tor Project either financially, as I have so generously throughout the years, nor by providing computing resources. This decision does not come lightly; I probably ran one of the first five nodes in the system and my involvement with Tor predates it being called "Tor" by many years. Nonetheless, I feel that I have no reasonable choice left within the bounds of ethics, but to announce the discontinuation of all Tor-related services hosted on every system under my control. Most notably, this includes the Tor node "Tonga", the "Bridge Authority", which I recognize is rather pivotal to the network Tonga will be permanently shut down and all associated crytographic keys destroyed on 2016-08-31. This should give the Tor developers ample time to stand up a substitute. I will terminate the chron job we set up so many years ago at that time that copies over the descriptors. In addition to Tonga, I will shut down a number of fast Tor relays, but the directory authorities should detect that shutdown quickly and no separate notice is needed here. I wish the Tor Project nothing but the best moving forward through those difficult times, --Lucky """""

5 9

As I was saying, the Turkish govt knew about the coup in advance
by Rayzer 19 Jul '16

19 Jul '16

...and pwned it. http://www.hurriyetdailynews.com/Default.aspx/?pageID=238&nID=101805&NewsCa… Now, as most intel news says, Erdogan has had a 'Pyrrhic victory'. https://www.google.com/search?&q=Erdogan+Pyrrhic+victory Meaning his NATO-allowed luv affair with ISIS and it's stolen oil (in return for gun-running/resupply logistics to them at the CIA's behest) is about to come to a screeching halt because the US and Russia are going to 'soft partition' Syria. That means ISIS and all it's islamist allies just became redundant, or else, IF Erdogan 'thinks he has cojones to buck his socio-psychopathic NATO 'friends', as another recent headline states: Turkey could 'turn into Syria or Libya' http://gulfnews.com/news/mena/turkey/fears-that-turkey-could-turn-into-syri… Rr

1 0

Cloudflare reCAPTCHA De-anonymizes Tor Users
by Rayzer 19 Jul '16

19 Jul '16

https://cryptome.org/2016/07/cloudflare-de-anons-tor.htm I pointed out that possibility regarding Hushmail in February 2015. http://auntieimperial.tumblr.com/post/111007562804 http://66.media.tumblr.com/acc793091fadb7eabc16dbf9705b2be3/tumblr_njs0wgov… It's especially treacherous if you do have something to hide, and helps them tune their shit, if you log in on tor, and also barefoot, at different times.

1 1

Hillary Clinton's Benghazi gun running - CCB report
by Zenaan Harkness 19 Jul '16

19 Jul '16

http://journal-neo.org/2016/07/19/an-ominous-truth-obama-s-america-stands-f… "Their [USA] refusal to even talk with Qaddafi to orchestrate a peaceful settlement on the eve of his death, that fact galvanizes their absolute intentions to overthrow the government. America put on the black hat out in the open for the first time ever in our history. Now Syria is a bloodbath." http://www.aim.org/benghazi/wp-content/uploads/2014/04/CCB-Interim-Report-4…

1 0

Re: [tor-talk] FBI cracked Tor security
by Mirimir 19 Jul '16

19 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/19/2016 04:18 AM, Jon Tullett wrote: > On 19 July 2016 at 12:01, Mirimir <mirimir(a)riseup.net> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> >> On 07/19/2016 03:50 AM, Jon Tullett wrote: >>> On 19 July 2016 at 08:31, Mirimir <mirimir(a)riseup.net> wrote: >>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >>>> >>>> On 07/18/2016 07:08 PM, Jon Tullett wrote: >>>>> On 18 July 2016 at 16:17, Mirimir <mirimir(a)riseup.net> >>>>> wrote: >>>>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >>> >>>>>> A few years ago, I wrote >>>>>> <https://www.ivpn.net/privacy-guides/will-a-vpn-protect-me>. >>>>> >>>>> >>>>>> Have you updated it to account for subverted VPN providers? >>>>> Advising people to use VPNs which may have been subject to >>>>> national security letters is arguably bad. >>>> >>>> Which VPNs have received NSLs? >>> >>> I take it that's a no, then? >> >> I account for it by distributing trust, just as Tor does. > > But your guide does not. It doesn't even mention them. Why are you > concealing the truth from users?!?11 This gets at the trust issue: | Using VPN services obscures online activity from local observers, | and it also obscures location and identity from remote observers | on the Internet. However, users are entirely vulnerable to | betrayal by the VPN provider. With a second VPN service tunneled | through the first, trust has been distributed, in that compromise | would require collusion between the two providers. That comes pretty close, I think. NSLs are really irrelevant in risk assessment. Because NSL or not, you have no way to know who you can trust. So you can't trust anyone. > The point I'm trying to make is that you can't cover every base. > Too often, attempts to do so just end up with unusable rambling > essays on security which no one will read and which still fail to > cover a lot of ground. You're accusing Tor of something that you > yourself can't avoid. That's not a criticism - just a reflection of > reality. Say what you will, this is misleading: | Tor prevents people from learning your location or browsing habits. <SNIP> -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXjgMTAAoJEGINZVEXwuQ+P4UH/3zyjj3FmgZTjH0Qe7pijN5s ETxHDAK5gZoGA/8VVeYIEG3SNg2rnNSc6cvD9aW5pdebdZfirtvuwY++vVrFw3P/ y5zqt+MQAdfcPlsFmpty5qkzKAAuO37/4m6yAEAxuTkJvfCpY/ThWVFy8xXk+OeV p2naoo5GFboRP3r4+N1nxY7DsgzwRfhkxVZQSxmPjJhEFxTvNiq2crAnvUHLrBJe 46QiWn+agldN54LxkPVasAUgd7RWirl4O+H9UhZumA2ZrBHNa4I5YYoOw28zc4Am /G2+Kdgst3Ua8em3D6LvNmQnMAUXi7NS5tAazl5IYpQsuj1G/jfkDnUtYeTJN1s= =+aIe -----END PGP SIGNATURE-----

1 0

Re: [tor-talk] FBI cracked Tor security
by Mirimir 19 Jul '16

19 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/19/2016 03:50 AM, Jon Tullett wrote: > On 19 July 2016 at 08:31, Mirimir <mirimir(a)riseup.net> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> >> On 07/18/2016 07:08 PM, Jon Tullett wrote: >>> On 18 July 2016 at 16:17, Mirimir <mirimir(a)riseup.net> wrote: >>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > >>>> A few years ago, I wrote >>>> <https://www.ivpn.net/privacy-guides/will-a-vpn-protect-me>. >>> >>> Have you updated it to account for subverted VPN providers? >>> Advising people to use VPNs which may have been subject to >>> national security letters is arguably bad. >> >> Which VPNs have received NSLs? > > I take it that's a no, then? I account for it by distributing trust, just as Tor does. > Point being, not only do we now know which operators have received > letters, we _can't_ know. The first rule of NSL club is you don't > talk about NSL club. I have yet to see much evidence that warrant > canaries help. And that's not the only risk; operators can be > coerced, hacked, suborned, or otherwise compromised. Belgacom, for > example. What Tor relays have received NSLs? > We mitigate that by layering services, but that's back to the > question of how complex an environment suits your risk profile. Not > everyone has the same nut; not everyone needs the same size > hammer. The NSA is a pretty big nutcracker ;) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXjfqHAAoJEGINZVEXwuQ+jfsH/j2m+GIEfHEG/Ye1mKviqiYB 2NpeeI5W/r6Zq/Bv/xoqnid+qhwtP/4BwkukXeJ2LhXHBinDKJuKJluOzqiSOqMI 7ThceELgk0ec2eiPSDNJAfH784ShDMpwZEJIJ4I6MmuPXBJ6CJFdzau0rf/M0vGT tm2m5SfPKh66ZvtGzvoHGsyUV0p1Hu5I3H3ID+EiBbP2uqSi/mL1OXaezT5tGamu OxczvVFo5cl3uGCJechHXq/jlTyiNrRf6YAUocitFXwXejMHpUQrvU/TlDnZqN5u rA9Ezxg2YFZ3NltC1Owob8oEgA8/VfWhUZ5v+w9poWG8c6WgOfB4pti5Jq6TAfo= =W8Yj -----END PGP SIGNATURE-----

1 0