- cypherpunks - lists.cpunks.org

Rojava - direct democracy, Kurdistan, gender equality, polyethnic
by Zenaan Harkness 06 Apr '16

06 Apr '16

Further to last years documentaries of this punk beginning, Rojava is moving up in the world. There's hope yet. - A wikipedia page :) https://en.wikipedia.org/wiki/Rojava - Russian military support for the Kurds http://www.washingtontimes.com/news/2016/feb/8/l-todd-wood-russia-supportin… http://www.euractiv.com/section/europe-s-east/opinion/why-a-pro-kurdish-rus… - Syria Kurds' First Foreign Office to Be Opened in Moscow http://russia-insider.com/en/syria-kurds-first-foreign-office-be-opened-mos… - The YPJ (their women's army) is still going strong; though I would have liked to see the Moscow PYD/YPD office include the YPJ.

1 2

You thought it was just your local ISP messing with your HTTP traffic
by Rayzer 05 Apr '16

05 Apr '16

From February this year: Website-Targeted False Content Injection by Network Operators Gabi Nakibly1,3, Jaime Schcolnik2, and Yossi Rubin3 1 Computer Science Department, Technion, Haifa, Israel 2Computer Science Department, Interdisciplinary Center, Herzliya, Israel 3Rafael – Advanced Defense Systems, Haifa, Israel Over the last few years there have been numerous reports of ISPs that alter or proxy their customers’ traffic, including, for example, CMA Communications in 2013 [6], Comcast in 2012 [16], Mediacom in 2011 [9], WOW! in 2008 [27], and Rogers in 2007 [32]. Moreover, several extensive studies have brought the details of this practice to light [17, 30, 25, 35]. The main motivations of ISPs to alter traffic are to facilitate caching, inject advertisements into DNS and HTTP error messages, and compress or transcode content. All of these reports and studies found that these traffic alterations were carried out exclusively by edge ISPs,namely, retail ISPs that sell Internet access directly to end customers, and are their “first hop” to the Internet. This finding stems from the server-centric approach the above studies have taken. In this approach, one or a handful of servers are deployed to deliver specific content to users, after which a large number of clients are solicited to fetch that content from the servers. Finally, an agent on the clients – usually a JavaScript delivered by the server itself – looks for deviations between the content delivered by the server and that displayed to the user. Figure 1(a)illustrates the traffic monitored in this server-centric approach. Such an approach can be used to inspect the traffic of many clients from diverse geographies who are served by different edge ISPs. The main disadvantage of this approach is that the content fetched by the clients is very specific. All clients fetch the same content from the same web servers. This allows only the detection of network entities that aim to modify all of the Internet traffic1 of a predetermined set of users and are generally oblivious to the actual content delivered to the user. Such entities indeed tend to be edge ISPs that target only the traffic of their customers. In this work we show that the above approach misses a substantial portion of the on-path entities that modify traffic on the Internet. Using extensive observations over a period of several weeks, we analyzed petabits of Internet traffic carrying varied content delivered by servers having over 1.5 million distinct IP addresses. We newly reveal several network operators that modify traffic not limited to a specific set of users. Such network operators alter Internet traffic on the basis of its content, primarily by the website a user visits. The traffic of every Internet user that traverses these network operators is susceptible to alteration." www.arxiv.org/pdf/1602.07128v1.pdf -- RR "Through counter-intelligence it should be possible to pinpoint potential trouble-makers ... And neutralize them, neutralize them, neutralize them"

4 5

NPR story: When A Dark Web Volunteer Gets Raided By The Police
by grarpamp 05 Apr '16

05 Apr '16

http://www.npr.org/sections/alltechconsidered/2016/04/04/472992023/when-a-d… He/they gave passwords and let govt search (and perhaps even index, hash, and copy, knowingly or not [1]) his (possibly then unencrypted) data. As opposed to having it confiscated pending potentially 2^128 time. Where is the principled stand there? [2][4] [1] This happened while he was detained outside / away from control of his systems. [2] He "may now have to get rid of his computers because he can't be sure what the police did to them [3]". For which giving passwords had no purpose but to nullify a potentially good test case, trample rights and replace "innocent till guilty" with "violated, chilled, innocent for now, while Cardinal Richelieu's database hums... ... If you give me six lines written by the hand of the most honest of men, whether or not I find something in them which will hang him, I will database them and own his soul forever." [3] Already did: https://twitter.com/SeattlePrivacy/status/716460499106340864 [4] Due credit, thugs with guns at your door does tend to modify even the most well thought and prepared for principles. What doesn't kill you makes you stronger for next time.

1 0

What's App End to End Encryption
by Yush Bhardwaj 05 Apr '16

05 Apr '16

http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ What's is also using AES, HMAC AND Elliptic Curve ? *Yush Bhardwaj*

2 1

NSL AmA with ACLU and CALYX
by grarpamp 05 Apr '16

05 Apr '16

https://www.reddit.com/r/IAmA/comments/4dcm55/we_are_aclu_lawyers_and_nick_…

1 0

Mossak Fonseca's statement
by Ben Mezger 04 Apr '16

04 Apr '16

http://www.scribd.com/doc/306839585/Declaration-de-Mossak-Fonseca-en-anglais "'Our firm, like many firms, provides worldwide regist ered agent services for our professional clients (e.g., lawyers, banks, and trusts) who are intermediaries. As a registered agent we merely help incorporate companies, and before we agree to work with a client in any way, we conduct a thorough due-diligence process, one that in every case meets and quite often exceeds all relevant local rules, regulations and standards to which we and others are bound."" -- Kind Regards, Ben Mezger https://benmezger.nl

1 0

Is it possible to leak huge load of data over onions?
by grarpamp 04 Apr '16

04 Apr '16

On 4/3/16, Griffin Boyce <griffin(a)cryptolab.net> wrote: > How do you transmit an elephant? One byte at a time... > > But on a serious note, it's possible to transfer 2.6TB over Tor in small > pieces (such as file by file or via torrent). Given the size, however, I'd > suspect they mailed hard drives after establishing contact with > journalists. Even on a fairly fast connection, 2.6TB would take quite a > while... That amount of data would take 27 days at 10Mbps. Few would be willing to sit supervising in a hotseat that long when they can physically mail 3TB for $100 and 8TB for $230. Though they might spend 3 days pushing 100Mbps via shells, etc. Overlay networks move data reasonably well, and reliability could be handled by chunking protocols. Available link speeds (thus path speeds) are likely to be limiting factor, ie: 10Mbps limits you to 100GiB a day. Though at 1Mbps, DVD torrenting on say I2P seems to be a thing.

2 1

Warrant canaries appear to be usable by large US companies - Reddit in this case
by Zenaan Harkness 04 Apr '16

04 Apr '16

Here and there someone pokes their illogical head up and says "Warrant canaries can't work" or "warrant canaries will get you introuble with the law" or some variation on the theme. It boggles me fookin marnd, it do. Perhaps this story can help massage some of those mental tensions... https://yro.slashdot.org/story/16/04/01/0321257/reddit-deletes-surveillance… "Reddit Deletes Surveillance 'Warrant Canary' In Transparency Report >From the deductive-reasoning department Arthur Dent '99 writes: Today, Reddit deleted wording in its transparency report that would normally indicate that they had not received any "national security letters" or "other classified requests for user information." Such "national security... " fooking fook!

4 4

solutions for source code take downs due to DMCA?
by Zenaan Harkness 04 Apr '16

04 Apr '16

brief github session: --- python-iview.gitm $ git fetch Username for 'https://github.com': zenaan Password for 'https://zenaan@github.com': remote: Repository unavailable due to DMCA takedown. remote: See the takedown notice for more details: remote: https://github.com/github/dmca/blob/master/2015-10-27-Python-iview.md. fatal: unable to access 'https://github.com/vadmium/python-iview.git/': The requested URL returned error: 503 --- My last change is: caf726732 2015-07-02 (HEAD, master) Humax retired; change to Panasonic feed I had plans to use it, but never quite got a round tuit, but I did grab a clone last year, to make sure I had a copy in case and or when I wanted or needed it. A DMCA takedown has happened since then. Finding alternative repos is not hard, but finding one which is updated is not something I have achieved - it looks like the DMCA ogre has wielded his club and squashed this probject, AFAICT. That's not good. It's not healthy for our (global) community. This feels like a problem we should be able to solve. Further info on this DMCA takedown: https://github.com/vadmium/python-iview https://github.com/github/dmca/blob/master/2015-10-27-Python-iview.md https://theconversation.com/python-iview-copyright-crusader-or-vigilante-op… http://www.mibus.org/2012/09/18/letter-to-the-abc-re-the-takedown-of-python… http://www.mibus.org/2012/09/23/doctor-who-sans-python-iview/ A foundational thought re freedom of information and freedom of culture and freedom to share comes to mind - are there any papers about any form of shock-test resistant hidden server design, e.g. with some number of trusted entry points into the TOR network to hide behind? It seems "we" have yet to design a functional hidden service? Zenaan

5 6

Finally, technology and justice come together
by Zenaan Harkness 03 Apr '16

03 Apr '16

Seems we need our government to issue breeding licenses and car cams to keep a close, and I mean close, eye on everyone. At least someone is finally putting technology to a good use, upholding justice, pricking the conscience and delivering some <ahem>firm, justice. America, that freedom lovin nation we all love to love. God bless America. https://yro.slashdot.org/story/16/04/02/1938216/oklahoma-video-vigilante-us… "Oklahoma Video Vigilante Uses Drone To Wage War Against Prostitutes and Johns HughPickens.com writes: Chris Baraniuk writes at BBC that Brian Bates, known in Oklahoma as the "Video Vigilante," is taking credit for Amanda Zolicoffer's conviction on a lewdness charge after being caught on Bates' drone mounted camera in a sex act in a parked vehicle last year. Zolicoffer was sentenced to a year in state prison for the misdemeanor while the case against her alleged client, who was released following arrest in December, is still pending. "I'm sort of known in the Oklahoma City area," says Bates . "For the last 20 years I've used a video camera to document street-level and forced prostitution, and human trafficking." Bates runs a website where he publishes videos of alleged sex workers and their clients. "I am openly referred to as a video vigilante, I don't really shy away from that," says Bates adding that the two individuals were inside a vehicle and the incident occurred away from other members of the public. The drone dropped to within a few feet of the vehicle where it filmed a 75 year old in the front seat of the white pickup truck. The duo separated after Zolicoffer, who was identified by her tattoo saying "Baby Gangster," saw the drone hovering overhead. "

1 0