- cypherpunks - lists.cpunks.org

Cloudflare reCAPTCHA De-anonymizes Tor Users
by Rayzer 19 Jul '16

19 Jul '16

https://cryptome.org/2016/07/cloudflare-de-anons-tor.htm I pointed out that possibility regarding Hushmail in February 2015. http://auntieimperial.tumblr.com/post/111007562804 http://66.media.tumblr.com/acc793091fadb7eabc16dbf9705b2be3/tumblr_njs0wgov… It's especially treacherous if you do have something to hide, and helps them tune their shit, if you log in on tor, and also barefoot, at different times.

1 1

Hillary Clinton's Benghazi gun running - CCB report
by Zenaan Harkness 19 Jul '16

19 Jul '16

http://journal-neo.org/2016/07/19/an-ominous-truth-obama-s-america-stands-f… "Their [USA] refusal to even talk with Qaddafi to orchestrate a peaceful settlement on the eve of his death, that fact galvanizes their absolute intentions to overthrow the government. America put on the black hat out in the open for the first time ever in our history. Now Syria is a bloodbath." http://www.aim.org/benghazi/wp-content/uploads/2014/04/CCB-Interim-Report-4…

1 0

Re: [tor-talk] FBI cracked Tor security
by Mirimir 19 Jul '16

19 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/19/2016 04:18 AM, Jon Tullett wrote: > On 19 July 2016 at 12:01, Mirimir <mirimir(a)riseup.net> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> >> On 07/19/2016 03:50 AM, Jon Tullett wrote: >>> On 19 July 2016 at 08:31, Mirimir <mirimir(a)riseup.net> wrote: >>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >>>> >>>> On 07/18/2016 07:08 PM, Jon Tullett wrote: >>>>> On 18 July 2016 at 16:17, Mirimir <mirimir(a)riseup.net> >>>>> wrote: >>>>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >>> >>>>>> A few years ago, I wrote >>>>>> <https://www.ivpn.net/privacy-guides/will-a-vpn-protect-me>. >>>>> >>>>> >>>>>> Have you updated it to account for subverted VPN providers? >>>>> Advising people to use VPNs which may have been subject to >>>>> national security letters is arguably bad. >>>> >>>> Which VPNs have received NSLs? >>> >>> I take it that's a no, then? >> >> I account for it by distributing trust, just as Tor does. > > But your guide does not. It doesn't even mention them. Why are you > concealing the truth from users?!?11 This gets at the trust issue: | Using VPN services obscures online activity from local observers, | and it also obscures location and identity from remote observers | on the Internet. However, users are entirely vulnerable to | betrayal by the VPN provider. With a second VPN service tunneled | through the first, trust has been distributed, in that compromise | would require collusion between the two providers. That comes pretty close, I think. NSLs are really irrelevant in risk assessment. Because NSL or not, you have no way to know who you can trust. So you can't trust anyone. > The point I'm trying to make is that you can't cover every base. > Too often, attempts to do so just end up with unusable rambling > essays on security which no one will read and which still fail to > cover a lot of ground. You're accusing Tor of something that you > yourself can't avoid. That's not a criticism - just a reflection of > reality. Say what you will, this is misleading: | Tor prevents people from learning your location or browsing habits. <SNIP> -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXjgMTAAoJEGINZVEXwuQ+P4UH/3zyjj3FmgZTjH0Qe7pijN5s ETxHDAK5gZoGA/8VVeYIEG3SNg2rnNSc6cvD9aW5pdebdZfirtvuwY++vVrFw3P/ y5zqt+MQAdfcPlsFmpty5qkzKAAuO37/4m6yAEAxuTkJvfCpY/ThWVFy8xXk+OeV p2naoo5GFboRP3r4+N1nxY7DsgzwRfhkxVZQSxmPjJhEFxTvNiq2crAnvUHLrBJe 46QiWn+agldN54LxkPVasAUgd7RWirl4O+H9UhZumA2ZrBHNa4I5YYoOw28zc4Am /G2+Kdgst3Ua8em3D6LvNmQnMAUXi7NS5tAazl5IYpQsuj1G/jfkDnUtYeTJN1s= =+aIe -----END PGP SIGNATURE-----

1 0

Re: [tor-talk] FBI cracked Tor security
by Mirimir 19 Jul '16

19 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/19/2016 03:50 AM, Jon Tullett wrote: > On 19 July 2016 at 08:31, Mirimir <mirimir(a)riseup.net> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> >> On 07/18/2016 07:08 PM, Jon Tullett wrote: >>> On 18 July 2016 at 16:17, Mirimir <mirimir(a)riseup.net> wrote: >>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > >>>> A few years ago, I wrote >>>> <https://www.ivpn.net/privacy-guides/will-a-vpn-protect-me>. >>> >>> Have you updated it to account for subverted VPN providers? >>> Advising people to use VPNs which may have been subject to >>> national security letters is arguably bad. >> >> Which VPNs have received NSLs? > > I take it that's a no, then? I account for it by distributing trust, just as Tor does. > Point being, not only do we now know which operators have received > letters, we _can't_ know. The first rule of NSL club is you don't > talk about NSL club. I have yet to see much evidence that warrant > canaries help. And that's not the only risk; operators can be > coerced, hacked, suborned, or otherwise compromised. Belgacom, for > example. What Tor relays have received NSLs? > We mitigate that by layering services, but that's back to the > question of how complex an environment suits your risk profile. Not > everyone has the same nut; not everyone needs the same size > hammer. The NSA is a pretty big nutcracker ;) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXjfqHAAoJEGINZVEXwuQ+jfsH/j2m+GIEfHEG/Ye1mKviqiYB 2NpeeI5W/r6Zq/Bv/xoqnid+qhwtP/4BwkukXeJ2LhXHBinDKJuKJluOzqiSOqMI 7ThceELgk0ec2eiPSDNJAfH784ShDMpwZEJIJ4I6MmuPXBJ6CJFdzau0rf/M0vGT tm2m5SfPKh66ZvtGzvoHGsyUV0p1Hu5I3H3ID+EiBbP2uqSi/mL1OXaezT5tGamu OxczvVFo5cl3uGCJechHXq/jlTyiNrRf6YAUocitFXwXejMHpUQrvU/TlDnZqN5u rA9Ezxg2YFZ3NltC1Owob8oEgA8/VfWhUZ5v+w9poWG8c6WgOfB4pti5Jq6TAfo= =W8Yj -----END PGP SIGNATURE-----

1 0

Pepe Escobar - Why the Pentagon and NATO Are Bluffing
by Zenaan Harkness 19 Jul '16

19 Jul '16

Enjoyable and grounded "where we're at now" sitrep from the ever entertaining Pepe Escobar, with some interesting (for my little mind) viewpoints: Why the Pentagon and NATO Are Bluffing "All bets are off if we have a Full Spectrum Dominatrix in Washington in 2017" http://www.strategic-culture.org/news/2016/07/17/why-pentagon-and-nato-are-… http://russia-insider.com/en/why-pentagon-and-nato-are-bluffing/ri15697 Also, that article links to a previous recent Escobar wrap, which my aging LCD monitor is half way through and riveted by: Beware what you wish for: Russia is ready for war https://www.rt.com/op-edge/344002-beware-russia-war-us/ Enjoy

1 0

Re: [tor-talk] FBI cracked Tor security
by Mirimir 19 Jul '16

19 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/18/2016 07:08 PM, Jon Tullett wrote: > On 18 July 2016 at 16:17, Mirimir <mirimir(a)riseup.net> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> >> On 07/18/2016 07:33 AM, Jon Tullett wrote: >>> On 18 July 2016 at 14:57, Mirimir <mirimir(a)riseup.net> wrote: >>>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >>>> >>>> On 07/18/2016 06:11 AM, Jon Tullett wrote: >>>> >>>>> Haroon Meer, who I greatly respect in the security space, >>>>> describes UX complexity in terms of his mum. As in, "could >>>>> my mum do this?" and if the answer is no, it's too complex >>>>> for the average user. I like that. >>>> >>>> His mum probably shouldn't be using Tor. >>> >>> Why not? Are you able to say with certainty that they are not >>> at risk and shouldn't be using Tor? Sounds like a risky >>> assumption. Not that it's applicable here, but activists' >>> families are not uncommonly at high risk. I'd caution against >>> assuming you know someone's risk profile better than they do. >>> And that, in a nutshell, is why I don't think Tor should be >>> making such an assumption in its recommendations to users in >>> general. >> >> Giving clueless folk an illusion of safety is arguably bad. > > Now you're back to "sheep". Don't assume that "technically > inexperienced" equates to "clueless". Well, say "technically inexperienced" if you like. In my world, we call that "clueless". I'm more or less clueless in many areas, and am not ashamed to admit it. > Security theatre is generally not positive, but again, security is > never absolute and you will always be able to find an argument for > doing more, and someone who will argue that failing to do so is, > yes, arguably bad. Everyone has to draw the line somewhere. Tor has > done so. Well, given what we know of TLA capabilities, what Tor Project says at <https://www.torproject.org/> is tantamount to false advertising: | Anonymity Online | | Protect your privacy. Defend yourself against network surveillance | and traffic analysis. Maybe so against local adversaries. But clearly not against global adversaries. Cynical folk note that so far, the US and its allies are the only known global adversary. And claim that this is self-serving bullshit. | Tor prevents people from learning your location or browsing habits. It for sure hasn't stopped FBI, with their honeypots that drop malware. And I doubt that it stops NSA/GCHQ. But Tor Project just postures about "bad FBI". They don't give naive users, who may be at risk, even a brief heads up about proxy leakage, and how to prevent it. Two or three years ago, even after the Freedom Hosting debacle, I was willing to cut Tor Project some slack. But after the PlayPen attack, it's becoming harder to escape the conclusion that Tor Project either doesn't want to mitigate this risk, or doesn't have the contractual freedom to do so. > We're going in circles on this now, so this will be my last > repetition of that particular argument. As I've said, I think we > agree there's room for better education, but just differ on > details. Fair enough :) >>>>> It's probably far more meaningful to help users understand >>>>> that spectrum, self-assess where they fall on it and what >>>>> their risk profile may look like as a result, and pointers >>>>> to resources which would align with that. >>>> >>>> That sounds good to me. Except that there's nothing on the >>>> Tor Project site about Whonix, and virtually nothing about >>>> proxy-bypass leaks. >>> >>> Why should there be mention of Whonix? It's an independent >>> project. >> >> What about >> <https://www.torproject.org/projects/projects.html.en>? > > That's a list of projects Tor is involved with. It's interesting > but there's no context - someone who knows they need the tool is > already most of the way there. Helping people identify that the > need the tool at all is the part I'm interesting in. It's my general impression that Whonix project has been actively rebuffed. But I have no inside knowledge. > (snip) >> Tails is on >> <https://www.torproject.org/projects/projects.html.en> but not >> Whonix. Why is that? > > At a guess, it's because Tor is more actively involved in Tails > than in Whonix. But that is just a guess. Have you asked the > maintainers? Yes, that does seem to be the case. But asking hasn't gotten me anywhere. Maybe some fly on the wall will dump some evidence ;) >>> Proxy bypass, maybe, but that's in there with all the other >>> potential risks, and again, Tor can't document all of them. >> >> Tor Project has made a huge deal over the PlayPen pwnage. >> Demanding that the FBI release information about its NIT. But >> they can't be bothered to actually explain how users could have >> been protected? > > Very different issues, I think. I'm sure you disagree; I'm not > going to debate it. I don't disagree that they're different issues. My point is that warning users about proxy bypass takes but a few words on a website, and maybe a link. And given that it's such an easy fix, I suspect that Tor Project either doesn't want to admit the risk so clearly, or is somehow being prevented from doing so. >>> That's a rhetorical question - I'm sure there are pros and >>> cons either way and it could be argued at length without >>> conclusion. I'm not convinced Tor should be promoting either; >>> same way I'm not convinced Tor should be promoting any specific >>> tools. There will always be others, and they may be better >>> suited to users depending on their circumstances. >> >> Sure. Except that proxy bypass has been a major fail. Do you >> disagree? > > Yes, I do. Systems get attacked, and are updated to thwart > attacks. Tor does this - that is not a fail, that's the normal > security dev process. Don't assume that nothing is happening - it's > not like Tor is not actively researched and developed. It's been at least five years! The relay early bug got fixed in months. Maybe devs are working on some integrated firewall or whatever. That would be cool. But Whonix isn't vulnerable, has been available for years, and gets no love. And it's not just Whonix. Other approaches that separate tor process and userland have also been largely ignored. >> A few years ago, I wrote >> <https://www.ivpn.net/privacy-guides/will-a-vpn-protect-me>. > > Have you updated it to account for subverted VPN providers? > Advising people to use VPNs which may have been subject to national > security letters is arguably bad. Which VPNs have received NSLs? Anyway, I don't assume that a particular VPN operator can be trusted any more than a particular Tor relay operator can. Just as Tor uses three-relay circuits, I recommend using nested VPN chains, with at least three different VPNs, operating in different jurisdictions. Some useful links: IVPN privacy guides: https://www.ivpn.net/privacy-guides VPN info/ratings: https://thatoneprivacysite.net/ VPN test results: https://vpntesting.info/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXjck/AAoJEGINZVEXwuQ+2hgH/38KYdqwRmjIoz/CnfVyizHv c6c0KnouGRfxXqMfC8wuIPG5rptIx22k0fZScv+vt+1OHJts6kzol2SUPMQKRnmo f6oBS7z7MBAJR+JEJ02LfPRMihl5/FzY4CupTE+kIQlg2cPj83jnmu1Ywdg+gLpi o21YNt9RdZhYjFPwtp7/4c70f6QBnNV/lNXLapBKciXbVhw+WClhanXnbqwgXZHr C8BkPnQ6M3KruNYueAD0lb0HSDBqd1l9lQmn5arRjpKbJctCP5joOOlXOMYHmugA 0/caDabgdG76rZE9l/9nFrE2mFvPfBSNHjjaWns8YNH0U0J54G1CEfCD6wJB0R4= =AA9M -----END PGP SIGNATURE-----

2 1

on grokiing intention
by Zenaan Harkness 19 Jul '16

19 Jul '16

When we see someone that we want to say "come in spinner" to, our first duty is to assume good intention. When we don't see what is horrific, that which is an abomination to human, an abomination to righteousness, and we see someone justifying it, qualifying it, basically being "apologetic" for it, it is too easy to see mal intent. However, the road to hell has a lot of paving. It is by the hand of our fellow humans that the many and varied well paved roads to hell, are so well paved! This affects us all! The snow jobs that are presented, the blindness, can be interpreted in different ways. Everyone has the opportunity, should they carpe diem, to wear a different hat when that hat is presented. To myself folks have kindly (usually) said "Hey Zenaan, that's pretty harsh" and "hey Zenaan, you're jumping to conclusions" and "oi Zenaan, you're raking someone over the coals, and they don't deserve it" and "Zenaan, you are emotionally vehement about this pet theory of yours, do you truly have any facts behind it", and far too many times folks have been right, and on those times I am able to wear another hat, to see my own blindness, I am very grateful (at least, sometimes, after licking my perceived wounds for a few days or weeks). What causes our blindness? - a desire to believe in our government/ system - attachment to our own beliefs/ world views - a belief in my/ my tribe's (my nation's) superiority - a "hippy" or fatalistic belief that "it all works out eventually, everyone's just doing their best, so it's all ok" But it's not all ok. There is much that is so very, very wrong. So wrong and so bad, it is evil in action. Unethical beyond belief. North America's incarceration rate of predominantly black people, mostly for purported "crimes" that harm no one, not a single person (e.g. smoking a bit of weed, selling a bit of weed, not paying a parking fine and being caught a few times with a "disqualified driver license" as a result, and doing 18 months jail the second and third times this then happens again). Men and women lose their jobs as a result of such evil. Single separated parents are unable to travel to see their children (withe the other parent) as a result of such evil. Families are broken up as a result of such evil (the bloke loses his license, cannot lawfully drive to work, loses his job, loses his sense of dignity, family breaks up.) We humans collectively via our tacit consent of our "democratic" governments, bring hell down on our neighbours, or on "other people in other suburbs who -must- be somewhat bad or they would not be in jail". We are so desperate to find "the evil out there" that a mere allegation of rape or pedophilia causes us to jump on a public lynch train. We are so bound in our "lives" that we vote over and over again for the mainstream political parties who are compromised in all ways and who continue the endless litany of murder by empire, day in, day out. We humans are fundamentally shameful, unable to break the chains of our schooling and programming, deceiving ourselves that the words used in an Act mean something other than what they say, hoping beyond fact, hoping beyond all evidence that our "government" is there to do (at least some) good. Violation of human rights, when instituted in statute, demonstrates an evil, on the record of the governments own Act. Here in Australia, us Aussies say about our GST tax "oh well, the government needs money to run, oh well, it's worse in other countries, oh well, the money is used for schools and hospitals" and yet the act says "The commissioner of taxation may deem an event that did not happen as having happened, and an event that did happen as having not happened, or may deem that an event that happened, actually happened at a time other than when it actually happened". And the people pay. The people consent. Yet more so, the people become apologists, trying to defend the indefensible "someone has to pay for the roads, that why we have road tolls" or "PGP gets an exemption" or "people die in cars, that's we have to have RFID sat tracking state issued driver licenses". We, humans, defend the indefensible. Scraping the barrell for some sanity where there is none. Assuming good intention in words which demonstrate evil intention, demonstrate the intention to remove human rights, intention to grant to the executive (government "officials") the power to demonically deem black to be white, truth to be falsity, falsity to be truth, and anyone they don't like to be a terrorist. When you accept the indefensible, even tacitly by doing no action in opposition, you contribute a little bit to that evil. When you try to defend the indefensible, it is a bit worse, because you lead others astray - the busy, the tired, those who might trust you without reading in depth, those who are unable to read, those who are naturally influenced by the "charisma" of someone speaking publicly. Better to say nothing, than to lead others astray. I am so very grateful when others have pointed out my bullshit - it's a small mercy, and much better than my bullshit prevailing. To those who care, let's lift our game! We can do better. To those who intentionally perpertrate deception, confusion, lies and evil, may the warriors of sanity tear your evil words to shreds!

6 30

Fwd: [tor-talk] webmail send while using TOR is tagged as spamends up in spam
by grarpamp 19 Jul '16

19 Jul '16

---------- Forwarded message ---------- From: Friet Pan <frietpan(a)ymail.com> Date: Tue, 19 Jul 2016 05:13:39 +0000 (UTC) Subject: [tor-talk] webmail send while using TOR is tagged as spamends up in spam To: tor-talk(a)lists.torproject.org i use yahoo to mail with mailinglists but i use TOR to connect to yahoo. tuns out that all my posts now end up in everyones spam folders. Is this because the tor exitnodes are used by spammers? or is every mail that was send from a TOR user falsely marked as spam? also the subscription confirmation email i received from this list ended up in yahoo's spam. So now i also wonder how many people on this list are not receiving THIS message. I'm NOT a spammer. Can i sue yahoo for falsely tagging my mails as spam? or better can TOR sue Yahoo? :-D and win and get a lot of money to put into development? please have a look at dmarc.org it tries to explain in lawyer-ish speak how the yahoo, gmail, facebook aol, paypal, ebay, amazon cartel teamed together to force people to 'autenticate' authenticate as in ...get a code that they can use to invade our privacy. (or is this my brain going into paranoia mode?) can this be fixed? Or do we need a new email protocol that respects privacy by default, decentralized, with whitelist and request to communicate and eventually a blacklist to be able to block extreme cases. is it enough to move away from yahoo, or will the same stuff happen when using another email provider? Thanks for improving my privacy! Wp -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

Happy 4 July!!!
by grarpamp 19 Jul '16

19 Jul '16

https://www.youtube.com/results?q=dylan+noble+body+cam The mentioned "kid shot in Fresno" releases and assorted LE / family interviews and commentary for eval above.

3 3

[OT] Where are your public keys people?
by Bastiani Fortress 18 Jul '16

18 Jul '16

12 23