- cypherpunks - lists.cpunks.org

Re: TSA Thugs: TSA Agents Beat And Jail Disabled Teen With Brain Cancer
by Cecilia Tanaka 04 Jul '16

04 Jul '16

On Jul 2, 2016 4:16 PM, "juan" <juan.g71(a)gmail.com> wrote: > > No country deserves respect and some countries are way more despicable than others. US ranks first. I love countries and their cultures, my dear. Unhappily, there are frontiers among all the countries. > It's funny. You got the american treatment in the tor mailing list. You saw what kind of garbage the boyces and the quinns posted here. And you are still making excuses for "the land of the free"? > > Something is very wrong. I admiss I didn't like Boyce, Dani Moth, Quinn and Ted's messages, but I am not "making excuses" for their country, Juan. Ted was the most aggressive of all and I think he was talking only about Zenaan and you, but he seems _a lot_ the kind of guy who shoots in someone's head saying that some people "deserves" it for being different. I was really shocked after reading his messages. Boyce's act of banning was disgusting, but what really upset me was the "rape apology" stuff. It was completely unnecessary and pretty sick knowing my past and details of my present. But, well, everybody knows his ego is much bigger than his intelligence. He is an intelligent guy, but is very pretentious. It always was usual inside Tor Project core team. He follows their patterns. In that occasion, I admiss I hoped sincerely that Boyce and Dani Moth were raped twice each one, because only a person who _really_ was raped can be completely sure that making "rape apology" always will be impossible for me. I love sex. Rape is not sex, it is violence, fury, torture. It's dark. It is to feel a dark and deep fear of death. Usually, I don't feel fear of death. It is the only certainty in this uncertain life. I swear I felt the same desperate fear of death when I was raped. Nobody deserves to feel this kind of despair. I was angry in that occasion and I sincerely apologize for wishing something so cruel for Boyce and Dani. I regret it a lot and ask pardon for being like them. It is not correct at all. Quinn is intolerant and has narrow patterns of decency, but he is a good person and I like him, Juan. You are not exactly tolerant and open-minded too, haha!! ;D > > [Cecilia] It would not be rational to hate USA for killing my family. > > "a 2015 Pew Research Center survey finds that the share of Americans who believe the use of nuclear weapons was justified is now 56%, with 34% saying it was not. " Sorry, I don't believe in all researches because I have lots of researchers as friends and colleagues and I was a researcher in several moments of my life too, my dear Juan. And you know, I am terribly hard headed like you, haha!! ;D http://www.globalresearch.ca/the-real-reason-america-used-nuclear-weapons-a… It was a political decision, not military, Juan. In all the countries, in all the places, the problem is the government, not the people. Few stupid and cruel politicians killed my family, not the North American people. There are lots of infinitely sad ghosts stories in Hiroshima. Shadows and eternal crying... I sincerely hope these sad ghosts haunt all the cruel politicians who decided to play with human lives. My migraine is still killing me and my mood is really bad. I don't like drugs, but tried a lots of medicines for pain in last days. My hard head and I think they didn't work, haha!! ;D I bet you will feel envy now, Juan. Coconut ice cream and sweet corn ice cream, nom nom... Trying usual food will be a disaster. Ice cream is a good choice when feeling sick. My mood will be better soon, hihi... <3 I was thinking about lemon and ginger popsicles, much better for sickness, but they had only creamy ice creams now. So, I will make tea. Hot and cold together, hihi... <3 You are a good person, my dear Juan. I was wrong about Razer and you being a couple in love. Now I hope you, Razer and Mirimir can make a lovely ménage à trois and being happy forever, hahaha!!! ;D Nope, I am sick and you are too far to kick my butt like a soccer ball... and Messi is not playing anymore, hahaha!! ;D

6 13

RE: [Cryptography] Android Full Disk Encryption Broken - Extracting Qualcomm's KeyMaster Keys
by Peter Gutmann 04 Jul '16

04 Jul '16

Jeffrey Schiller <jis(a)mit.edu> writes: >If you look at the exploit you will see it is a simple case of failing to >check array/string bounds. ... which is exactly what was exploited in the 2013 attack, alongside a whole boatload of other missing defensive features, no DEP, no ASLR, executable stack, strcpy()s all over the place, it was described at the time as a "hack like it's 1999" attack. As I said in the previous post, security is more than just a fancy name and a lot of marketing, you have to actually make an effort to make it secure. Oh, and given that this looks like a repeat of the same flaws from three years ago, patching your insecure code also helps. Peter.

1 0

RE: [Cryptography] Android Full Disk Encryption Broken - Extracting Qualcomm's KeyMaster Keys
by Peter Gutmann 04 Jul '16

04 Jul '16

Jerry Leichter <leichter(a)lrw.com> writes: >Lessons? Generality and power lead (to complexity, which is the enemy of >security. I think a more direct lesson here is that taking a security mechanism that consists of a bit flag used to tag a block of memory, defining any such tagged area as secure by executive fiat, and selling it as TrustZone, is no match for, you know, actually doing real security. It's not like this hasn't happened before, in 2013 Motorola cellphones got 0wned via attackers targeting the insecure TrustZone and attacking from inside that out to the (apparently) quite secure non-TrustZone code. Peter.

1 0

Re: DHS et al: Mass Transit Audio Spies
by Fulano Diego Perez 04 Jul '16

04 Jul '16

Subject: Re: DHS et al: Mass Transit Audio Spies Date: Sun, 3 Jul 2016 17:16:07 -0700 From: Jason McVetta <jason.mcvetta(a)gmail.com> To: cpunks <cypherpunks(a)cpunks.org> > Those who have nothing to say, have nothing to fear. > > On Sun, Jul 3, 2016 at 11:45 AM, grarpamp <grarpamp(a)gmail.com > <mailto:grarpamp@gmail.com>> wrote: > > http://www.csoonline.com/article/3090502/security/big-brother-is-listening-… > > https://audiofingerprint.openwpm.com/ This page tests browser-fingerprinting using the AudioContext and Canvas API. Using the AudioContext API to fingerprint does not collect sound played or recorded by your machine - an AudioContext fingerprint is a property of your machine's audio stack itself. If you choose to see your fingerprint, we will collect the fingerprint along with a randomly assigned identifier, your IP Address, and your User-Agent and store it in a private database so that we can analyze the effectiveness of the technique. We will not release the raw data publicly. A cookie will be set in your browser to help in our analysis. We also test a form of fingerprinting using Flash if you have Flash enabled. This page is a part of Princeton CITP's Web Transparency and Accountability Project. For questions or concerns email dreisman(a)princeton.edu and ste(a)cs.princeton.edu

1 0

Android Full Disk Encryption Broken - Extracting Qualcomm's KeyMaster Keys
by grarpamp 04 Jul '16

04 Jul '16

http://bits-please.blogspot.fr/2016/06/extracting-qualcomms-keymaster-keys.… https://github.com/laginimaineb/ExtractKeyMaster https://github.com/laginimaineb/android_fde_bruteforce https://github.com/laginimaineb?tab=repositories In this blog post, I'll demonstrate how TrustZone kernel code-execution can be used to effectively break Android's Full Disk Encryption (FDE) scheme. We'll also see some of the inherent issues stemming from the design of Android's FDE scheme, even without any TrustZone vulnerability. A couple of months ago the highly-publicised case of Apple vs. FBI brought attention to the topic of privacy - especially in the context of mobile devices... Full disk encryption is used world-wide, and can sometimes be instrumental to ensuring the privacy of people's most intimate pieces of information. As we've seen, the current encryption scheme... can be hacked by an adversary or even broken by the OEMs...

4 3

Journalists Fucked... by FBI, and by Themselves (via Appelbaum at CIJ Berlin)
by grarpamp 04 Jul '16

04 Jul '16

https://freedom.press/blog/2016/06/leaked-fbi-documents-reveal-secret-rules… The leaked rules The Intercept has published give us a revealing and startling look at how the FBI can conduct surveillance of journalists in complete secrecy and with no court oversight. https://www.youtube.com/watch?v=KJValv4YQcY I understand you think me your political enemy...

2 1

DHS et al: Mass Transit Audio Spies
by grarpamp 04 Jul '16

04 Jul '16

http://www.csoonline.com/article/3090502/security/big-brother-is-listening-…

2 1

[OT] Five Simple Rules
by Cecilia Tanaka 04 Jul '16

04 Jul '16

Most of all know about my love for fun subjects, like Law, comics, music, open data and Astronomy. Below, a small excerpt of Neil deGrasse Tyson's last speech in the new "Cosmos" series. It is really beautiful and inspiring not only for researchers, but for everybody who wants to search for truth. "How did we, tiny creatures living on that speck of dust, ever manage to figure out how to send spacecraft outer among the stars of the milky way? Only a few centuries ago, a mere second of the cosmic time. We knew nothing of where and when we were. Oblivious to the rest of the cosmos, we inhabited a kind of prison, a tiny universe bounded by a nutshell. How did we escape from the prison? It was the work of generation of searchers, who took 5 simple rules to heart. Question authority. No idea is true just because someone says so, including me. Think for yourself. Question yourself. Don't believe anything just because you want to. Believing something doesn't make it so. Test ideas, by the evidence gained from observation and experiment. If a favorite idea fails a well designed test, it's wrong. Get over it. Follow the evidence, were ever it leads. If you have no evidence, reserve judgement. And perhaps even the most important rule of all, remember you could be wrong. Even the best scientist have been wrong about somethings. Newton, Einstein, and ever other great scientist in history. They all made mistakes. Of course they did, their were human."

6 18

Report: US crypto regulation... flawed
by grarpamp 03 Jul '16

03 Jul '16

https://www.theguardian.com/technology/2016/jun/29/government-encryption-re… https://homeland.house.gov/wp-content/uploads/2016/06/Going-Dark-Going-Forw… US Republican congressional staff trying to find a middle ground on encryption have said previous efforts to regulate privacy technology were flawed and that lawmakers need to learn more about technology before trying to regulate it, according to a report released on Wednesday.

2 1

using gnupg with mutt
by Zenaan Harkness 03 Jul '16

03 Jul '16

Does anyone know how to have an automatic association between a pgp public key and a 'specified by me' email address? As in, some people create gpg keys which do not include their email address, and I would have thought it trivial for me, in my own keyring, to associate a public key I have received, with one or more email addresses of my choosing (and / or the person's name, as fair as I know the name etc). gpg --edit-key HASH brings up a prompt, and help gives things like trust and list, and there is a "notation" sub command which sounds perfect for the job, but can only operate on private keys, not public keys. This all does not make sense to me. When someone sends me an email, signed with their private key, and I get a copy of their public key, I should be able to associate their public key, with their email address, even if their own signing of their pub/sub public key does not include that particular (or any) email address. What gives? TIA

5 4