- cypherpunks - lists.cpunks.org

[linux-elitists] Browser fingerprinting
by Eugen Leitl 21 Oct '13

21 Oct '13

----- Forwarded message from Don Marti <dmarti(a)zgp.org> ----- Date: Sun, 6 Oct 2013 11:11:46 -0700 From: Don Marti <dmarti(a)zgp.org> To: linux-elitists(a)zgp.org Subject: [linux-elitists] Browser fingerprinting Message-ID: <20131006181146.GA21225(a)zea.gateway.2wire.net> User-Agent: Mutt/1.5.21 (2010-09-15) Corporate speak: "Tawakol and Ingis both said the new technology, which is still under development, would allow companies to use alternative approaches that are sometimes called statistical or probabilistic tracking, while remaining in compliance with industry privacy standards." Translation: "Fine, you smug cookie-blocking nerds. We're going to go all browser fingerprinting on you." http://blog.sfgate.com/techchron/2013/10/04/ad-groups-prepare-for-cookieles… Mozilla has been working on cleaning up the third-party cookie problem, and making a dent in it, as you can tell by the complaints from the creepy adtech business. Unfortunately, Firefox appears to be highly fingerprintable. https://panopticlick.eff.org/ says "Your browser fingerprint appears to be unique among the 3,458,043 tested so far." Ouch. Got to get my act together here. But of course the more that I customize, the more unique my browser looks. Who's got a browser that comes up reasonably generic on Panopticlick, and what did you do? -- Don Marti +1-510-332-1587 (mobile) http://zgp.org/~dmarti/ Alameda, California, USA dmarti(a)zgp.org _______________________________________________ Do not Cc: anyone else on mail sent to this list. The list server is set for maximum one recipient. linux-elitists mailing list linux-elitists(a)zgp.org http://zgp.org/cgi-bin/mailman/listinfo/linux-elitists ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

18 33

Snowden Comsec Is Stupefying
by John Young 21 Oct '13

21 Oct '13

We still don't know, and likely will never know, what is in the Snowden collection. Admirable as his courage may be, he erred in handing it over to media incapable of assessing the whole wad, which has led to the teasing and hyperbolized accounts valorizing crypto to armor info-warriors. Perhaps more capable assessment is being done and will be made public in a credible fashion instead of the goofy call for debate before much is known beyond rhetoric and hype. The heavy-handed redactions suggest official advice threats and culling, and do not augur well for seeing the rest. Stupid claims of hiding the collection, insurance as stupid as that of WikiLeaks, stupidly sending some or all of it to other parties, come across as patent dissimulation of the comsec advertising type. Comsec is now a fat mark-up of junk, espoused by stupid comsec advisers to journalists as if a saintly medallion to stop a bullet.

4 6

<nettime> Why Glenn Greenwald's new media venture is a big deal
by Joly MacFie 21 Oct '13

21 Oct '13

Why Glenn Greenwald?s new media venture is a big deal By HENRY FARRELL Oct 17 2013 < http://www.washingtonpost.com/blogs/monkey-cage/wp/2013/10/17/why-glenn-gre… > Glenn Greenwald, who has published many of the most important scoops from the Edward Snowden leaks, is leaving The Guardian and setting up a new media venture with long-time journalist Laura Poitras and Jeremy Scahill from The Nation. The venture is being funded by eBay founder Pierre Omidyar, who has suggested that he?s prepared to invest more than $250 million in the new venture. This is big news for journalism. It?s also big news for people interested in the relationship between information technology and politics. Martha Finnemore and I drafted a paper a couple of years ago about how Wikileaks-type organizations were changing the relationship between knowledge, politics and hypocrisy. Our ideas about hypocrisy led to an article on the true consequences of the Snowden leaks, which is coming out in the next issue of Foreign Affairs. Our ideas about knowledge and politics maybe tell us something about the consequences of the new venture (but bear with me ? our argument is a little complicated). Fundamentally, we think that much of the commentary about Wikileaks and Snowden?s revelations are wrong. Most people think that Wikileaks, Snowden etc. are politically important because they reveal secret information that was hitherto unknown. Many of Wikileaks? defenders, including, initially, Julian Assange himself, thought that the organization would change politics and bring down corrupt regimes by revealing information that the government wanted to hide. The critics of Snowden and Wikileaks actually agree ? they argue that they have hurt America (and perhaps the world) by revealing information that should have stayed secret. Neither are right. Neither Wikileaks or Snowden has revealed any truly surprising anddamaging information. European and South American governments already knew that the U.S. was spying on them. China was certainly aware that U.S. agencies were trying to hack into its systems. On the other hand, Assange?s initial hope that he could change the world through publishing damaging information turned out to be completely unfounded. Wikileaks had a very frustrating time trying to get anyone except bloggers to pay attention to their early revelations. No one seemed to care. The reason why is important. There?s too much information out there for most people to pay attention to, let alone figure out whether they believe it or not. Hence, most people rely on other institutions such as media organizations to tell them which information is worth caring about. Not only do people not pay much attention to information until it gets the stamp of approval from some authoritative institution, but this information is transformed, because everybody knows that everybody else is paying attention to it. It stops being mere information, and becomes knowledge ? generally accepted facts that people use to build their understanding of what everybody knows about politics. Established newspapers like the New York Times, The Washington Post and the Financial Times play a crucial sociological role in deciding which information is important and trustworthy, and which is not. When one of these newspapers publishes information, it is legitimated as knowledge ? which people are not only more likely to take seriously themselves, but may have to take seriously, because they know that other people are taking it seriously. European Union governments knew perfectly well that the U.S. had been tapping communications in their building (and if you read specialist sources, you knew about this, too). However, these governments found it more politically convenient to ignore U.S. spying than to make a big fuss. When this information became knowledge ? when it was published and treated as authoritative by major newspapers ? it became impossible to ignore any longer. Assange and Wikileaks figured out some version of this early on. This is why they started working together with major newspapers such as the Guardian and New York Times ? because this was the only way that they could get people to systematically pay attention to the information they had uncovered, and to turn that information into knowledge that everyone accepted. Unsurprisingly, however, this relationship turned out to be very difficult. Newspapers ? even the most pioneering ones ? have political relationships with governments, which make them nervous about publishing (and hence validating) certain kinds of information. This also helps explain the awkwardness that many journalists express toward Greenwald. While they recognize that he has uncovered many valuable scoops, they don?t see him as bounded by the same rules as they are. On the one hand, people like Assange, Greenwald and Snowden need newspapers or similar media outlets. Without some such outlet, they are voices in the wilderness. On the other hand, exactly because newspapers play a crucial political role in validating knowledge, they have complicated relationships with governments and politicians. This leads them to actions which people like Assange and Greenwald are likely to see as compromises with power. [snip] via Dewayne-Net RSS Feed: <http://dewaynenet.wordpress.com/feed/> -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- - # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org

1 0

[tt] NYT: Seeking Online Refuge From Spying Eyes
by Frank Forman 21 Oct '13

21 Oct '13

Seeking Online Refuge From Spying Eyes http://bits.blogs.nytimes.com/2013/10/19/seeking-online-refuge-from-spying-… By JENNA WORTHAM Consider this scene in "The Circle," Dave Eggers's new novel that imagines a dystopian future dominated by an omnipotent social networking company: Mae, the young protagonist, tries to unplug from her hypernetworked life to go on a covert, solitary kayaking trip. But when she returns to shore, she is greeted by police officers who have been alerted to her excursion by several hidden cameras. She quickly realizes that very little in her life isn't recorded, tracked and analyzed. It's a troubling image, one that some fear might not be limited to works of fiction. In fact, some elements of Mae's scenario have emerged recently in the news. There was the report that the National Security Agency can create sophisticated maps of some people's personal information and social connections. There were the recent changes to Facebook's privacy settings that will no longer allow users to hide their profiles from public searches. In addition, Google recently revealed that it was considering using anonymous identifiers to track browsing habits online, raising hackles among privacy advocates who have described it as "the new way they will identify you 24/7." And, at the same time, drones are becoming commonplace--used by the government in counterterrorism efforts and by hobbyists-- prompting discussions about the long-term impact on privacy. These developments, among others, have spurred the creation of a handful of applications and services intended to give people respite and refuge from surveillance, both online and off. They have a simple and common goal: to create ways for people to use the Internet and to communicate online without surveillance. Nadim Kobeissi, a security adviser in Montreal who works on an encrypted-message service called Cryptocat, said the security and hacker circles of which he is a part have long suspected that the government is listening in on online conversations and exchanges but "have never been able to prove it." He added: "It's been a worst-case-scenario prediction that all turned out to be true, to a worrying extent." If nothing else, the N.S.A. leaks and disclosures have brought these issues front and center for many people, myself included, who are troubled by how much of our daily and online interaction is concentrated in and around a handful of companies that have funneled data to the N.S.A. "It's sad that this is the proverbial kick in the butt that needs to bring awareness to this concept," said Harlo Holmes, who works for the Guardian Project, a group that is building several anti-surveillance and privacy applications. Ms. Holmes says interest has been surging in the Guardian Project's services, which include tools that let people make phone calls over the Internet which the organization says cannot be recorded. More than a million people have downloaded an app called Orbot that allows users to send e-mails anonymously through mobile devices. She said it was common to assume that people who want to avoid detection online are doing illicit things, like trying to buy drugs or look up illegal content--and that may happen. But it is certainly not the intent. She says the Guardian Project and its peers are built for people who live under governments that don't allow access to the Web or to certain apps, as well as for people who simply don't like the idea of their online activity being tracked and monitored. Ms. Holmes says that most of the tools are used by people in totalitarian states. "We get a lot of feedback from people who use it to get access to blogs and sites they can't access because of a firewall," she said, referring, for example, to a government blocking access to Twitter. Most of these services are still relatively small. For example, Cryptocat, the encrypted-message service, typically sees peaks of around 20,000 simultaneous users. In recent months, that number has grown to 27,000. But it's a far cry from the hundreds of thousands, or even millions, that mainstream social networking tools and services can claim. "As good as all of our intentions are, whatever looks good and is user-friendly gets critical mass," she said. "That is what is going to take off." But those who work on these services say they don't have to compete directly with the Facebooks, Twitters and Googles of the world. They just have to offer an alternative, independent space where people can interact if and when they need to. Dan Phiffer works on a project called Occupy.here that gives people access to a private messaging forum by creating small, localized pockets of Internet access. People who are nearby and whose laptops or mobile devices detect the network are directed to a discussion board where they can interact. Inspired by the Occupy Wall Street protests in 2011, the idea was to allow activists and organizers to interact in a way that would be hard for police officers to track. His project is naturally resistant to Internet surveillance, "but its original purpose was not for countersurveillance," he said. "What I am trying to do is build alternative online spaces for supporting activists and those who might be sympathetic to their cause." Mr. Phiffer also thinks that the project can have much larger implications and motivate "broader political engagement by offering a tool for people who are tired of the disregard of their civil liberties by their government." Of course, there is no guarantee that the Guardian Project, Mr. Kobeissi's project, or any others like it are safe from being broken into by a government or a hacker or another entity. But Mr. Kobeissi said that there was an upside to all of the disturbing security disclosures: at least now, he said, the security world can deal with the information disclosed in leaks "on a per-revelation basis" to make its own offerings stronger and more secure. The truth, he said, is that "we are developing software in an unknown environment, even though we know so much about the threats being posed." "The specifics are always changing," he added. Tools like Cryptocat, he said, are just the impetus for a larger discussion. "It's not an answer by itself," he said. "It is a combination of privacy and technology, democratic movement and political discussion that it is not acceptable to use the Internet as a surveillance medium." _______________________________________________ tt mailing list tt(a)postbiota.org http://postbiota.org/mailman/listinfo/tt

1 0

Information Content Estimation
by Cathal Garvey (Phone) 20 Oct '13

20 Oct '13

Hey all, Am mulling over a federated datastore for zero-knowledge web applications, using hashcash as a "commitment" price for otherwise gratis data storage. All very straightforward, but: Zero knowledge is as much for host protection as client protection. Hosts don't WANT plaintext. Short of stupidly CPU-intensive stuff like letter counting, UTF8 decoding, etc, how might a server verify it's receiving encrypted data? I was thinking a function that estimates apparent entropy and rejects anything that doesn't look random enough to be encrypted, what such functions are available, fast, widely implemented? -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 1

Re: In Over My Head -- What do I need to setup a tiny ISP?
by Miles Fidelman 20 Oct '13

20 Oct '13

Notify Me wrote: > > That being said, some people who have a lot more faith in my abilities than > I do seem to think I am the go-to guy for network information. And they > foolishly asked me for assistance in putting together a small ISP network > which is supposed to cater for home users inside of a residential area, > very likely wireless (wifi/WIMAX). > A key question: is this going to be a commercial service run as a business, or an internal operation like a campus network? The operations aren't that different, but the scope and organiation can be different. Another key question: Are you focusing just on the infrastructure (wireless IP) or will you be providing email, hosting services, and so forth? > I confess I am really interested in helping my questioners put this > together, not just for whatever material gain (which is unlikely at this > point), but just for the experience which is very valuable to me. I also > have to state that I live in Nigeria, so whatever advice you offer has to > be fourth-world applicable. > > I admit that your query raised my interest, so I did a little looking, and found this: http://www.fnbc.info/sites/default/files/fck-uploads/file/fntc/ISP%20Guide%… A guide put together by the "First Nations Technology Council" - on how to put together an ISP on tribal lands in Canada - which might be somewhat analogous to your situation. It's somewhat basic, but gives an overview - then you can start looking into the individual topics it talks about. You might drop them an email. There's also been a lot of work on US tribal reservations that might apply - you'll have to do some googling to find resources. Now the guy you really want to talk to is Dave Hughes, of Big Sky Telegraph - who used to do a lot of network building for rural areas in the US and remote areas around the world - unfortunately he's long retired - but two sources you could look at that might give you a lot of background: http://www.bigskytelegraph.com/ (which now seems to lead to the Dillon Center of Excellence, focusing on best practices for rural America, including networking) and http://www.davehugheslegacy.net/ There used to be an "Association for Community Networking" - folks involved in building cooperative local networks (used to be a lot of what I was involved in the 1990s) but that kind of activity has dried up as more and more commercial players entered the market. And an "Organization for Community Networks" (http://ofcn.org/) - but their web site seems to be kind of dead (some useful links, though). If you google "community network" you'll find a buch of current operations - and you might want to contact some of them. There are also a growing number of community mesh networks in various places - WikiPedia's page on http://en.wikipedia.org/wiki/Wireless_community_network might be a good starting point. There's also an association of wireless ISPs http://www.wispa.org/ Then there's this guy: https://www.facebook.com/theispguy - who seems to have written a book on "so you want to be an ISP" - can't say anything about how good it is. Or.. you might just go looking for other ISPs in Nigeria (of which there are quite a few) and see if you can get some advice (amazing what you can learn over a few beers). Maybe contact the networking people at the nearest college or university. I don't know what it's like in Nigeria, but in the US, the academic community was really active in getting a lot of early ISPs started - particularly in smaller communities. One other thought: there are quite a few software packages floating around for managing aspects of ISP operations (see https://wiki.debian.org/HostingControlPanels for starters) - I expect their user communities (and email lists) would be excellent sources of information. Hope this helps. Regards, Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

1 0

please ignore: this is only a test...
by brian carroll 20 Oct '13

20 Oct '13

(dealing with list formatting mechanics and rendering issues) // no other way to do this, apologies... meant for follow-on post // preferably want to embed text array though line-wrap issues. // potential that quoted test can surpass limit though need to test it // outside of a post to not degrade readability.... quoted, line-wrap (y/n) (another reference test) - 78 character monospaced Courier New font, > quoted to test line wrap > > XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX > XX XX > gmail indented, line-wrap (y/n) (another reference test) - 78 character monospaced Courier New font, quoted to test line wrap XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX gmail double quoted line-wrap (y/n) (another reference test) - 78 character monospaced Courier New font, >> quoted to test line wrap >> >> XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX >> XX XX >> > indented then quoted, line-wrap (y/n) (another reference test) - 78 character monospaced Courier New font, > quoted to test line wrap > > XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX > XX XX > {whitespace}

15 20

[OT, Kind of] Carrier Retention Windows
by J.A. Terranson 20 Oct '13

20 Oct '13

This is also on Cryptome, I believe, but this one is more accessible, so... Handy chart of cell phone company records retention periods for 6 major carriers, obtained by the ACLU from a 2010 DOJ list: https://www.aclu.org/cell-phone-location-tracking-request-response-cell-pho… //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another.

1 0

Re: [Richard Crisp] Cheney afraid of terrist h4x0rs
by shelley＠misanthropia.info 19 Oct '13

19 Oct '13

If you're going to send bullshit comments off-list, don't expect me to jump through hoops to reply (see below.) To answer your remark, no I do not support "Ovomit" as you call him, nor any of the other treasonous fucks running this crazy train off the rails.  (Nor Ron Paul, etc, to answer your inevitable retort.) -S From: Richard Crisp <rdcrisp(a)earthlink.net> Date: Oct 19, 2013 4:20 PM Subject: Re: Cheney afraid of terrist h4x0rs To: <shelley(a)misanthropia.info> Let me guess: you support Ovomit  From: rdcrisp(a)earthlink.net Date: Oct 19, 2013 4:24 PM Subject: Re: Re: Cheney afraid of terrist h4x0rs To: shelley(a)misanthropia.info I apologize for this automatic reply to your email. To control spam, I now allow incoming messages only from senders I have approved beforehand. If you would like to be added to my list of approved senders, please fill out the short request form (see link below). Once I approve you, I will receive your original message in my inbox. You do not need to resend your message. I apologize for this one-time inconvenience. Click the link below to fill out the request: https://webmail.pas.earthlink.net/wam/addme?a=rdcrisp@earthlink.net&id=11e3…

1 0

Re: Snowden sets OPSEC record straight
by John Young 19 Oct '13

19 Oct '13

Snowden filtered by Janes Risen filtered by New York Times, as with all other filterings by special-interested Snowden filters, does deliver a reassuring message to precisely answer highly filtered questions and charges that have been made about his heavily filtered, nay, almost negligible releases. Perhaps Snowden actually speaks in person, appears in a filtered documentary, in a WikiLeaks filtered video, emails encryptically! via Greenwald and Risen, like a character from a brain-washing film, formulaicly, always on point, no ifs and buts, no waverings from propaganda-like rationales and justifications. But so far every version of his apperances by whatever medium come across as carefully vetted by WikiLeak's Sarah Harrison, lawyers and PR wizards, as over-edited, sanitized and directed, as little substantiated despite alleged thousands of documents as hard driven advocacy so like reviled special-interested groups of all persuasions. This critique applies to the dog and pony shows now ranging the globe by freedom of information special interests, staffed by a coterie of so-called ex-spies, their lawyers, their PR wizards, national security journalists and civil liberties exploiters, bedded and applauded by camp followers, funded by egotically, narcissisticly bored and wealth-drunk patrons like Omidyar, Soros, and, why not j'accuse the combine, the USG and its filthy rich spies long known to use the wealthy to protect their common special interests since corruption was invented, Day One. Snowden is either an ignorant fool, seduced along with Manning, by the narcotic dispensed by govs, NGOs, spies and the wealthy "to do good" or a fabulous con artist like Assange to "fleece the fuckers" as he emailed January 2007, via leaks extortion, that is, adopt the strategy and tactics of the "enemy" to seduce others into their concentrated wealth carnal palace. At 01:08 AM 10/18/2013, you wrote: >On Thu, Oct 17, 2013 at 9:42 PM, Juan Garofalo <juan.g71(a)gmail.com> wrote: > >... > > He's still loyal to the american nazis. That's praiseworthy? > > >he is showing extraordinary discretion and restraint, and an >underlying approval for some fundamental american ideals, like >guaranteed right to individual privacy, though of course this should >extend to the world not just US citizens. > >let's not forget that Guardian was forced to move this reporting to >the USA, because of GCHQ/her majesty's interference. and of course >there are plentiful locales where the activities of anyone involved >would strongly encourage a less than discrete "summary lack of >continued living incident" of some obscure manner. > >at any rate, this is too long and detailed a conversation for today.

3 2