- cypherpunks - lists.cpunks.org

Transparency and the price of anonymity
by Troy Benjegerdes 13 Jan '14

13 Jan '14

> > > your transactions EASILY are visible at blockchain.info and walking the chain back > > still waiting for zerocoin to get merged into mainline ... *cough* Zerocoin has not been merged because it is not sufficiently funded. If I thought it actually worked, I'd merge it into a *coin client and give end-users a choice if they want to blacklist any coins touched by zerocoin, or if they wish to pay the public cost to provide private anonymity. The problem with anonymity is it's *expensive* to actually have meaningful protection from people that would lock you up or make you dead, and I have not seen any credible way for the anon community to actually pay scientists and developers to design, build, and most importantly **TEST** various types of remailers, mixers, and laundry machines. I've decided it's far less costly *for me personally* to be completely transparent, and do my best to live in a way which has nothing to hide. Yes, that is potentially dangerous, just as it was dangerous for the man who stood in front of a tank in Tiananmen square, and it was dangerous for Edward Snowden publicly leak documents. However, I think the public and onymous (having a name) demonstrations of principle in full view of the world have a far greater leverage on public opinion than acts without a face or a name. If the only secrets I have are the private keys which protect my ability to publicly and securely validate who I am, the world seems to be a far less dangerous place, and one that is much easier to live and let live. So I understand those of you who need to remain names without a face, and I want you to be able to be free as in freedom to live. But freedom is not free as in beer, and there is a cost. I'd like an open and transparent discussion about how to fund that cost, starting with whether http://en.wikipedia.org/wiki/The_Transparent_Society may be a solution. -- Troy Benjegerdes

1 0

Hector "Sabu" Monsegur Sentencing 2 April 2014
by John Young 13 Jan '14

13 Jan '14

Hector "Sabu" Monsegur sentencing 2 April 2014: http://cryptome.org/2014/01/monsegur-13-0113.htm This is the latest postponement as Sabu continues assisting authorities sweep up his confederates and other cyber targets. Also helped by an undentified informant who ratted Sabu. This has netted about 16 indictments, presumably more in the pipeline, some of whom are likely pressured to name even more. Fantastic security business, shopping anonymouses.

2 1

Pretty Curved Privacy.. ECC Curve p25519 util(Bernstein approved curve)
by gwen hastings 13 Jan '14

13 Jan '14

>From the README... DESCRIPTION Pretty Curved Privacy (pcp1) is a commandline utility which can be used to encrypt files. pcp1 uses eliptc curve cryptography for encryption (CURVE25519 by Dan J. Bernstein). While CURVE25519 is no worldwide accepted standard it hasn't been compromised by the NSA - which might be better, depending on your point of view. Caution: since CURVE25519 is no accepted standard, pcp1 has to be considered as experimental software. In fact, I wrote it just to learn about the curve and see how it works. Beside some differences it works like GNUPG. So, if you already know how to use gpg, you'll feel almost home. QUICKSTART Lets say, Alicia and Bobby want to exchange encrypted messages. Here's what the've got to do. First, both have create a secret key: Alicia Bobby pcp1 -k pcp1 -k After entering their name, email address and a passphrase to protect the key, it will be stored in their vault file (by default ~/.pcpvault). Now, both of them have to export the public key, which has to be imported by the other one. With pcp you can export the public part of your primary key, but the better solution is to export a derived public key especially for the recipient: Alicia Bobby pcp1 -p -r Bobby -O alicia.pub pcp1 -p -r Alicia -O bobby.pub They've to exchange the public key somehow (which is not my problem at the moment, use ssh, encrypted mail, whatever). Once exchanged, they have to import it: Alicia Bobby pcp1 -P -I bobby.pub pcp1 -P -I alicia.pub They will see a response as this when done: key 0x29A323A2C295D391 added to .pcpvault. Now, Alicia finally writes the secret message, encrypts it and sends it to Bobby, who in turn decrypts it: Alicia Bobby echo "Love you, honey" > letter pcp1 -e -i 0x29A323A2C295D391 -I letter -O letter.z85 cat letter.z85 | mail bobby(a)foo.bar pcp1 -d -I letter.z85 | less And that's it. Please note the big difference to GPG though: both Alicia AND Bobby have to enter the passphrase for their secret key! That's the way CURVE25519 works: you encrypt a message using your secret key and the recipients public key and the recipient does the opposite, he uses his secret key and your public key to actually decrypt the message. Oh - and if you're wondering why I named them Alicia and Bobby: I was just sick of Alice and Bob. We're running NSA-free, so we're using other sample names as well. INSTALLATION There are currently no packages available, so pcp has to be compiled from source. Follow these steps: First, you will need libsodium: git clone git://github.com/jedisct1/libsodium.git cd libsodium ./autogen.sh ./configure && make check sudo make install sudo ldconfig cd .. Next, pcp: git clone git://github.com/tlinden/pcp.git cd pcp ./configure sudo make install cd .. Optionally, you might run the unit tests: make test DOCUMENTATION To learn how to use pcp, read the manpage: man pcp1 7. Licensed under the GNU GENERAL PUBLIC LICENSE version 3. HOME The homepage of Pretty Curved Privacy can be found on http://www.daemon.de/PrettyCurvedPrivacy. The source is on Github: https://github.com/TLINDEN/pcp -- Tentacle #99 ecc public key curve p25519(pcp 0.15) 1l0$WoM5C8z=yeZG7?$]f^Uu8.g>4rf#t^6mfW9(rr910 Governments are instituted among men, deriving their just powers from the consent of the governed, that whenever any form of government becomes destructive of these ends, it is the right of the people to alter or abolish it, and to institute new government, laying its foundation on such principles, and organizing its powers in such form, as to them shall seem most likely to effect their safety and happiness.’ https://github.com/TLINDEN/pcp.git to get pcp(curve25519 cli)

10 24

WebRTC for P2P [was Re: Replacing corporate search engines with anonymous/decentralized search]
by coderman 13 Jan '14

13 Jan '14

On Sun, Jan 12, 2014 at 6:53 PM, Jesse Taylor <jessetaylor84(a)riseup.net> wrote: > ... > What would make more sense, and would lead to much more rapid/widespread > adoption, is to use protocols like WebSockets / WebRTC to facilitate P2P > connectivity in the web browser, so that everything can be done via a simple > browser plugin that can be installed by anyone with few clicks, and would > then just allow people to use the browser search bar as usual.... > > To help bootstrap the WebRTC nodes into the P2P network, and to deal with > some of the instability inherent in P2P networks (i.e. by creating stable > "super-peer" indexing nodes), I like cathalgarvey's suggestion of utilizing > something like a Wordpress plugin that would use the same index/search > standard as the WebRTC clients, but could additionally bootstrap the > web-based clients. > ... > I've been looking around for some kind of WebRTC P2P search engine and > haven't found anything yet ... maybe I've found a programming project for > this summer :) WebRTC sockets in browsers for P2P would be an interesting project; this has been brought up here and there for various purposes, yet I can't find many resources on this either. interop is much better than when i last checked! http://www.webrtc.org/interop and WebRTC is actually working in the browser i'm using: https://apprtc.webrtc.org widespread use given a compelling use case is feasible, and a much lower bar than third party application installs or Java apps require. i would be interested in following your progress if you do start coding on this... best regards,

3 2

None
by David - 13 Jan '14

13 Jan '14

So I am organizing a lottery, I think you are all familiar with the concept. There is currently one death pool with multiple people in it. The pool accepts bitcoin and litecoin, and accurate death predictions will be rewarded 75% of the funds. The other 25% will stay in the pool for the remaining names. You can find more information at: http://lotteryd77nqcmtc.onion Or clearnet: http://lotteryd77nqcmtc.onion.lu

6 8

Bitcoin washing
by grarpamp 13 Jan '14

13 Jan '14

On Sun, Jan 12, 2014 at 7:53 PM, Rich Jones <rich(a)openwatch.net> wrote: > Seems to me the only way to anonymously use BitCoin is to never > tie them to your actual identity whatsoever. Seems that'd be about as hard as breaking your stash into possibly thousands of random sub $casual amount pots and shuffling/washing them about would be. Though both are possible does anyone bother? The problem for large balances is even more... spottable reconvergence of the amount on the other side. You'd need to close out at the thousands stage post wash instead of reconverging. It might help if there were a few large essentially free random washing machines operating in the anonymous space to encourage all transactions to be scrambled and swapped. Localbitcoin equivalents might be the only real in/out points available for such things and even that's not always perfect. > coderman: > still waiting for zerocoin to get merged into mainline ... *cough* topic related: coinjoin / coinswap https://bitcointalk.org/index.php?topic=279249.0 https://bitcointalk.org/index.php?topic=321228.0

1 0

FUCK SVEASOFT! Who the fuck uses dd-wrt anymore? Re: Tor now built into DD-WRT
by Anonymous Remailer (austria) 13 Jan '14

13 Jan '14

sveasoft broke the GPL years ago.. and was FULL of security holes.. most smart folk moved to open-wrt years ago where tor is a compile away also no fees $$$(SVEASOFT) for what is free software FUCK SVEASOFT!! fucking GPL Pirates and scammers

1 0

Re: Replacing corporate search engines with anonymous/decentralized search
by Jesse Taylor 13 Jan '14

13 Jan '14

Thanks for your comments on this folks ... lots of food for thought. coderman(a)gmail.com <mailto:coderman@gmail.com> said: /the longer discussion is how to make decentralized search useful. "Google style" search has a terrific performance advantage over decentralized designs by brute force. however, take advantage of massive endpoint / peer processing and resources combined with implicit observational metrics for reputation and recommendation, inside a well integrated framework for resource discovery in usable software, and you have something more robust and more effective than "Google style" could ever provide./ Yes, it does seem like the speed advantage of centralized search will be a barrier to adoption of decentralized search. This is analogous to the difficulty getting people adopt systems like Tor because it is slow. But I think that as more people become aware of the extent of state/corporate surveillance, they will become more inclined to accept solutions that are slower in exchange for not having their search habits monitored, and also being able to receive uncensored search results. As long as decentralized search is (a) usable/simple and (b) provides quality results, I feel like speed is somewhat of a secondary concern. The key question to me is: "How do we build a search engine that is simple enough for Grandma to use <http://freehaven.net/anonbib/cache/usability:weis2006.pdf>, that produces quality results without massive centralized indexing servers?" Standalone P2P search applications (e.g. Yacy) don't really make sense from a usability perspective. It's unrealistic to expect hundreds of millions of users to download a standalone Java app, and configure a P2P search node. What would make more sense, and would lead to much more rapid/widespread adoption, is to use protocols like WebSockets <http://mikemp.mit.edu/wss/wss-mikemp.pdf> / WebRTC <http://inet.cpt.haw-hamburg.de/papers/vws-lwpcd-13.pdf> to facilitate P2P connectivity in the web browser <http://inet.cpt.haw-hamburg.de/teaching/ws-2012-13/master-projekt/maxjonas-…>, so that everything can be done via a simple browser plugin that can be installed by anyone with few clicks, and would then just allow people to use the browser search bar as usual. This browser integration would also have the bonus of simplifying the choice of what to index -- it could just default to indexing bookmarked and frequently-visited pages, and then be optionally customized by more advanced users to create custom indexes (i.e. all of the complexity of setting up indexing could be hidden from the user, unless they choose to look for it). To help bootstrap the WebRTC nodes into the P2P network, and to deal with some of the instability inherent in P2P networks (i.e. by creating stable "super-peer <http://infolab.stanford.edu/%7Ebyang/pubs/superpeer.pdf>" indexing nodes), I like cathalgarvey's suggestion of utilizing something like a Wordpress//plugin that would use the same index/search standard as the WebRTC clients, but could additionally bootstrap the web-based clients. As cathalgarvey said:/ / /A standard rather than a codebase. But there's a huge advantage to this line of thought, if you'll bear with me. A two-digit fraction of the web right now is powered by Wordpress.org, who explicitly advocate open/free culture. If you can convince them to include a social search/index standard of this type, which is virtually free in terms of computer resources, then you'd have it deployed across the web in days as the next update rolled out. Indeed, even if Wordpress seemed reluctant, a wordpress plugin could probably be written quickly enough to enable such a thing and make it available for casual use. Suddenly, a bunch of PHP-powered sites around the web start committing small bits and pieces of resources to a social search engine based on human-curated attestations of trust that flow through a web, helping to confine spammers to the fringes and to users with stupid taste. / What would also be interesting is if this standard enabled some kind of "pingback" mechanism whereby WebRTC nodes could be associated with specific super-peer nodes (e.g. maybe people who have bookmarked the super-peer site in their browser, or subscribe to its feed), so that in addition to broad/random queries that target the entire P2P network, clients could also create more targeted custom searches that say something like "start the search with the nodes that are clustered around these super-peers". This would create an enormous diversity of search possibilities -- hundreds of thousands (millions) of different "search engines", each of which would return different results for the same query, depending on where you start your search ... This diversity is another reason I find P2P search interesting, in addition to the benefits re: censorship, traffic shaping, and surveillance. I've been looking around for some kind of WebRTC P2P search engine and haven't found anything yet ... maybe I've found a programming project for this summer :) -- Jesse Taylor <http://www.interference.cc>

1 0

Re: 'Jury Booty' and Anti-prosecution tactics. (Was Re:)
by John Young 13 Jan '14

13 Jan '14

This has got to be a spoof. The real Jim Bell would never write this. Unless under pressure to ensnare the stupid and sending a coded message to stay far away. We recently got one of these stay-far-away messages from a noted ISP we had tried to contract who said three customers had been taken down. Wouldn't say why. This ISP fought against keeping an NSL secret for years and lost.

2 2

Re:
by John Young 12 Jan '14

12 Jan '14

The joke about TCM is that this is a spoof like Tim May used to post. If not a spoof better not go there. At 04:59 PM 1/12/2014, you wrote: >Can you elaborate a bit about the panic onion? >Why is reachability and not content the indicator of the service's health? > > >On Sun, Jan 12, 2014 at 12:32 PM, John Young ><<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: >Welcome back, TCM. You've been missed. > > > > >At 12:46 PM 1/12/2014, you wrote: >So I am organizing a lottery, I think you are all familiar with the concept. >There is currently one death pool with multiple people in it. > >The pool accepts bitcoin and litecoin, and >accurate death predictions will be rewarded 75% >of the funds. The other 25% will stay in the pool for the remaining names. > >You can find more information at: ><http://lotteryd77nqcmtc.onion>http://lotteryd77nqcmtc.onion >Or clearnet: ><http://lotteryd77nqcmtc.onion.lu>http://lotteryd77nqcmtc.onion.lu > > > > > > >-- > > >Rich Jones > ><https://openwatch.net>OpenWatch is a global >citizen news network. Download OpenWatch ><https://itunes.apple.com/us/app/openwatch-social-muckraking/id642680756?ls=…>for >iOS and ><https://play.google.com/store/apps/details?id=org.ale.openwatch&hl=en>for >Android!

1 0