- cypherpunks - lists.cpunks.org

The cheap low risk node majority attack, pki, geoip, etc
by grarpamp 09 Jun '16

09 Jun '16

On 6/6/16, Steve Kinney <admin(a)pilobilus.net> wrote: > Since nobody asked, here's a description of why neither TOR nor any > other existing or presently planned anonymizing protocol I know of can > be relied on to conceal a user's identity from the Five Eyes or any of > several other hostile actors. I surface this concept every year or > so, but so far nobody seems interested in discussing it. Maybe it's > just too discouraging to think about. No matter who created it or > why, TOR and similar mix networks are at best security theater, > relative to top tier State adversaries. > > what if an effectively unlimited number of compromised routers, > subject to realtime observation and internal manipulation, were > available to hostile actors? Game over, I think. > > About 15 years ago I used online traceroute utilities and whois > lookups to determine (roughly) where all the high performing Mixmaster > remailers were physically located. Over half of them, including most > with "exotic sounding" TLDs, were apparently in the state of Texas. > > Then I used my data to construct "hard to compromise" chains, routing > Mixmaster messages through national jurisdictions not likely to have > comprehensive data sharing between their security services, and > started sending test messages. None of these test messages ever made > it back to me. > > So I concluded that, despite its major technical superiority to other > anonymized networking protocols, the Mixmaster network was most likely > compromised by passive observation (one owner for a majority of > reliable remailers) and active intervention (traffic between > uncontrolled remailers interrupted in transit). > > Owning enough of the routers in an anonymizing network to negate its > security is largely a question of money: How much budget to you have, > how certain do you want to be that nobody is really anonymous? While money can buy shill humans to stand in, as below, it's costly, and casual human interactions by multiple signers reviewing them may expose them to risk. > proxy hosts could be machines owned by "friendly" actors, rooted > consumer grade routers, purpose built appliances, conventional Windows > botnets or some combination of these. Govt seems to have no issue doing such illegal / unethical things. And they certainly can use their own network, tor, to do it. > The only defense I can think of is to assure that message traffic > passes back and forth between mutually hostile national jurisdictions > before delivery. This is suggested often on tor-talk. And tor devs continually pass on it. > This would be a bit of a hairball to implement Not really. Tor already loads GeoIP. So 20 or so lines of code and you've got a separate country for each hop. A few more lines to define groups like FVEY / BRICS, hemispheres, regions, AS, etc. Users could isolate on whatever they wanted. And a bunch more lines to include attributes as to "verified to be a human node operator in person" pki web of trust into the consensus. At least that way it raises the cost and risk to adversaries who today just use their Govt credit card to order up VPS nodes all over the world. Does it benefit? Tor devs say trust the random node selection. Others say at least some subset of users know the / their environment better and could use such tools to advantage. Tor still refuses to do it. So like mixmaster, you have to do it yourself. That sucks. It could stand to be talked over a bit more. > have to be taken into account. But this approach could increase the > cost and reduce the reliability of Hydra attacks against anonymizing > Long story short: If you want to be /really/ anonymous in the > presence of hostile State sponsored actors, do not rely on a > software-only approach: Use physical security measures to conceal > your identity from the physical router that connects you to the > Internet > No "airtight" security protocol has ever survived contact > with end users. password:12345, lol.

6 19

Re: [private] Re: [tor-talk] http://jacobappelbaum.net/
by Александр 08 Jun '16

08 Jun '16

Unambiguous and comprehensive response from Jacob Appelbaum himself to all this dirty slander toward him! If this kind of response "does not enough" for you, people, - just go fuck yourself. http://www.twitlonger.com/show/n_1soorlp Jacob Appelbaum · @ioerror 6th Jun 2016 from TwitLonger Berlin, June 6, 2016 In the past few days, a calculated and targeted attack has been launched to spread vicious and spurious allegations against me. Given the way these accusations have been handled, I had little choice but to resign from my position as an advocate at the Tor Project and devote my full attention to completing my doctoral work on cryptography at the Technical University of Eindhoven. Vague rumors and smear campaigns against me are nothing new. As a longtime public advocate for free speech and a secure internet, there have been plenty of attempts to undermine my work over the years. Now, however, these unsubstantiated and unfounded attacks have become so aggressive that I feel it’s necessary to set the record straight. Not only have I been the target of a fake website in my name that has falsely accused me of serious crimes, but I have also received death threats (including a Twitter handle entitled ‘TimeToDieJake’). I think it’s extremely damaging to the community that these character-assassination tactics are being deployed, especially given their ugly history of being used against fellow members of the LGBT community. It pains me to watch the community to which I’ve dedicated so much of my life engage in such self-destructive behavior. Nonetheless, I am prepared to use legal channels, if necessary, to defend my reputation from these libelous accusations. I want to be clear: the accusations of criminal sexual misconduct against me are entirely false. Inevitably, there may have been moments in my professional or private life when I may have inadvertently hurt or offended others’ feelings. Whenever I was aware of these instances, I have, and will continue to, apologize to the friends and colleagues in question and to continually learn how to be a better person. Though the damage to my reputation caused by these allegations alone is impossible to undo, I nonetheless take the concerns of the Tor community seriously. To dispel any further rumors, to the best of my knowledge, the Tor network is not ‘compromised.’ I’ve dedicated my life as a journalist, activist, and longtime member of the Tor Project to advocating for the transparency of public processes and to speaking out about the necessity of privacy, security, and anonymity. These are ideals that I will continue to uphold, despite the vicious campaign that is currently being waged against me. Jacob Appelbaum · @ioerror

9 24

Re: [tor-talk] Has anyone HEARD from IOError since his last tweet?
by grarpamp 08 Jun '16

08 Jun '16

On 6/6/16, juan <juan.g71(a)gmail.com> wrote: > The accussations are false, yet he leaves the oh so amazing tor > project, AND his own bosses throw him under the bus? > > https://blog.torproject.org/blogs/ssteele > > Something doesn't add up. Perhaps the adversary grew weary / wary of its useful idiot. Perhaps the useful idiot was too pure / against the system, which itself just went through a change of its own guard. Perhaps the useful idiot discovered a secret. The system is mind control. Yet within the mindless babble of idiots lies a certain insight. Listen to them.

2 2

Re: [tor-talk] CULT OF THE DEAD COW Statement on Jacob Appelbaum / ioerror
by grarpamp 08 Jun '16

08 Jun '16

On 6/7/16, juan <juan.g71(a)gmail.com> wrote: > > cult of the clown cow vomited : >> [chunks] > Just in case somebody out there hasn't yet realized what kind > of 'collective' fraud the 'hacker' 'community' is. > > The 'hacker' 'community' is actually a bunch of posseurs and > intellectual frauds, slightly more knowledgable than script > kiddies and fully aligned with the US establishment. > > >> We understand the >> complicated relationship we all have with law enforcement, > > as in, "we are a bunch of sell outs" Sellouts, rats, and snakeoil... LoL... now that's closer ontopic cpunk than all this ioerror interpersonal bs... With Tangent, Ratte, L0pht as grand IPO brokers and VC money. DEFCON's coming up, better buy your tickets. And wear your shades. > If the most extreme >> of these allegations are true, they should be addressed in a court of >> law, and dealt with appropriately. Word.

1 0

GNU's "anonymous-but-taxable electronic payments system" Heh.
by Robert Hettinga 06 Jun '16

06 Jun '16

<http://www.theregister.co.uk/2016/06/06/gnu_cryptocurrency_aims_at_the_main…> The Register GNU cryptocurrency aims at 'the mainstream economy not the black market' GNU and an outfit called “Inria” have released Alpha code – version 0.0.0 to be precise – of an anonymous-but-taxable electronic payments system they say is “a currency for the mainstream economy, and not the black market.” “Taler”, as the effort is dubbed, looks to be an attempt to build on the concepts behind Bitcoin. So while Taler lets you use encrypted “coins” as a means of exchange, it is explicitly not a new currency. Instead, it “... uses an electronic exchange holding financial reserves in existing currencies.” “This means that Taler is not a new currency with the inherent currency fluctuation risks, but instead the cryptographic coins correspond to existing currencies, such as US Dollars, Euros or even BitCoins.” The technology is also designed to be open enough that governments can peer inside, levy “sales, value-added or income taxes”. As a GNU project, the code is of course freely-available. For now, the effort is in its very early stages. GNU even warns, in the announcement of the project's debut, that “There is no auditor, and hence components do not properly support auditors either. As a result, a dishonest exchange could embezzle funds.” There's also no real-world integration at present, “so only toy currencies are available for now.” If you're interested regardless of those foibles, the 0.0.0 code does include “key components providing logic for running a bank, exchange, merchant and wallet.” That code is described as follows: • Exchange implements the full Taler protocol, but does not integrate with traditional banking systems (only with Taler's own "bank"). • Wallet can withdraw and spend coins, but does not yet handle refreshing, refunding, synchronizing, or export of cryptographic proofs. Some error handling may be insufficient. The wallet was only tested with Chrome/Chromium. • Merchant backend can generate contracts and handle payments, but does not yet offer full back-office support for tracking payments received. Frontend examples are available in Python and PHP. • The bank can manage accounts, allows the wallet to withdraw funds and can receive payments from the exchange. Inria and GNU hope to have more advanced versions of Taler to share by year's end. When they do, it may well be game on in the cryptocurrency space: Taler's already used fighting words with its “mainstream, not black market” talk. Bitcoin's many admirers may take offence at that kind of language and point to strong adoption. Sceptics can point to security woes among Bitcoin exchanges, governance woes and the cryptocurrency's volatility as evidence that different approaches to electronic currencies probably won't hurt their evolution. ®

3 2

Re: [tor-talk] Has anyone HEARD from IOError since his last tweet?
by Александр 06 Jun '16

06 Jun '16

Unambiguous and comprehensive response from Jacob Appelbaum himself to all this dirty slander toward him! If this kind of response "does not enough" for you, people, - just go fuck yourself. http://www.twitlonger.com/show/n_1soorlp Jacob Appelbaum · @ioerror 6th Jun 2016 from TwitLonger Berlin, June 6, 2016 In the past few days, a calculated and targeted attack has been launched to spread vicious and spurious allegations against me. Given the way these accusations have been handled, I had little choice but to resign from my position as an advocate at the Tor Project and devote my full attention to completing my doctoral work on cryptography at the Technical University of Eindhoven. Vague rumors and smear campaigns against me are nothing new. As a longtime public advocate for free speech and a secure internet, there have been plenty of attempts to undermine my work over the years. Now, however, these unsubstantiated and unfounded attacks have become so aggressive that I feel it’s necessary to set the record straight. Not only have I been the target of a fake website in my name that has falsely accused me of serious crimes, but I have also received death threats (including a Twitter handle entitled ‘TimeToDieJake’). I think it’s extremely damaging to the community that these character-assassination tactics are being deployed, especially given their ugly history of being used against fellow members of the LGBT community. It pains me to watch the community to which I’ve dedicated so much of my life engage in such self-destructive behavior. Nonetheless, I am prepared to use legal channels, if necessary, to defend my reputation from these libelous accusations. I want to be clear: the accusations of criminal sexual misconduct against me are entirely false. Inevitably, there may have been moments in my professional or private life when I may have inadvertently hurt or offended others’ feelings. Whenever I was aware of these instances, I have, and will continue to, apologize to the friends and colleagues in question and to continually learn how to be a better person. Though the damage to my reputation caused by these allegations alone is impossible to undo, I nonetheless take the concerns of the Tor community seriously. To dispel any further rumors, to the best of my knowledge, the Tor network is not ‘compromised.’ I’ve dedicated my life as a journalist, activist, and longtime member of the Tor Project to advocating for the transparency of public processes and to speaking out about the necessity of privacy, security, and anonymity. These are ideals that I will continue to uphold, despite the vicious campaign that is currently being waged against me. Jacob Appelbaum · @ioerror

2 1

Re: [tor-talk] A possible solution to traffic correlation attacks,
by grarpamp 05 Jun '16

05 Jun '16

On 6/5/16, Not Friendly <notfriendly(a)riseup.net> wrote: > After about an hour of brain storming I may of found a way to stop traffic > correlation attacks. The idea is to add an artificial delay of a few > randomized ms (two separate delays, one to the tor exit and another deal on > traffic exiting the network) and add an extra chunk of randomized data (just > a small random amount of KB that never exits the network). It would make > traffic harder to correlate. What are your thoughts on this? Doesn't work. "never exits" - GPA's don't necessarily need to correlate any internal flows. They can look only at the endpoints. The minute you insert traffic that lights up some other endpoint, in an otherwise sufficiently quiet network, or distinguishable way (bytes / latency [pump], which is made even easier for them if they reign over an endpoint), you're done. You need fulltime regulated fill traffic, within which, your traffic resides.

1 0

How long before compulsory microchipping of cattle, I mean, 'citizens'?
by juan 05 Jun '16

05 Jun '16

I'll hazard : 20 years. http://www.bbc.com/news/uk-35972480

11 24

Then there were two... IoError retires from torproject
by Rayzer 05 Jun '16

05 Jun '16

...and from what I'm seeing it looks like there's a crude disinformation/smear campaign to make it look like he bowed out because of pederasty accusations. while his most recent tweet (5/30) simply says "Change of the guard" See this twitter thread: https://twitter.com/Asher_Wolf/status/738924124920119296 The disinfo/slander op: https://twitter.com/TimeToDieJake LOOKS LIKE an Institutional Slander operation to get @ioerror to do an "Aaron Swartz" or "Ian Murdock". The other of the two who've departed torproject recently, @isislovecruft, fled to Germany because of harassment by FBI. CNN > http://money.cnn.com/2016/05/17/technology/tor-developer-fbi/

7 21

Re: [tor-talk] http://jacobappelbaum.net/
by Александр 05 Jun '16

05 Jun '16

*Slander, slander, slander* (collective & well planned one) - that is always the name of the game, when "they" want to destroy someone. People, at least if you don't want to make war and defend your friend/fellow worker/comrade in arms...(it is more difficult than "just ignore it" and put likes on facebook, right?) - at least don't you believe in everything you read. Qui habet aures audiendi, audiat. 2016-06-04 22:22 GMT+03:00 jacob appelbaum (ioerror) questions < jacobappelbaum.net(a)yandex.com>: > They say Jacob Appelbaum finally raped enough people that Tor as an > organization couldn't ignore it anymore. According to the Tor Project, the > circumstances surrounding Jake's departure are a personal matter. > > http://jacobappelbaum.net/ > -- > tor-talk mailing list - tor-talk(a)lists.torproject.org > To unsubscribe or change other settings go to > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk >

1 0