- cypherpunks - lists.cpunks.org

Re: [Cryptography] Proof-of-Satoshi fails Proof-of-Proof.
by Tony Arcieri 07 May '16

07 May '16

On Fri, May 6, 2016 at 12:06 PM, Ron Garret <ron(a)flownet.com> wrote: > > But with all forms of DH based signatures, a random number is generated > and that affects the signature value. In effect, every signature has a salt > value. Interesting sidebar: ECDSA nonces were one of the sources of Bitcoin's transaction malleability. The (massive pile of hacks that is) segregated witness feature being added to Bitcoin has an added side effect of removing signatures from the hash of a transaction, and with it the associated malleability. All that said, if you're designing a new system today, pick Ed25519. -- Tony Arcieri

1 0

Craig Wright suspends campaign to be the 2016 Satoshi Nakamoto
by Rayzer 06 May '16

06 May '16

Aussie entrepreneur Craig Wright backed off from his offer to produce more evidence that he is Bitcoin creator Satoshi Nakamoto. He's also wiped his website, except for a final, rather ominous message. http://boingboing.net/2016/05/05/craig-wright-reneges-on-offer.html

2 1

Cryptome
by Ryan Carboni 03 May '16

03 May '16

What is Cryptome? "Cryptome welcomes documents for publication that are prohibited by governments worldwide, in particular material on freedom of expression, privacy, cryptology, dual-use technologies, national security, intelligence, and secret governance -- open, secret and classified documents -- but not limited to those." A trollish statement saying, "everything in short". Cryptome insinuated that Protonmail is less secure after using an israeli reverse proxy ( https://web.archive.org/web/20160318180805/https://cryptome.org/2015/11/pro… ). How is it less secure? Protonmail's response: https://protonmail.com/support/knowledge-base/protonmail-israel-radware/ It says something if Fox News allowed a favorable AP report on Cryptome on their website: http://www.foxnews.com/us/2013/03/09/older-less-flashy-than-wikileaks-crypt… https://web.archive.org/web/20160329170005/http://www.theregister.co.uk/201… John Young states that Wikileaks is a criminal organization for needing money. Compare and contrast Cryptome and Wikileaks: The Wau Holland Foundation collected $1.2 million for Wikileaks, and later no longer could recieve donations from Paypal, while it's charitable status was challenged and revoked by German authorities. Cryptome is now a non-profit.

5 4

Needs more hardware hacking dox
by Steve Kinney 03 May '16

03 May '16

Annual token on-topic post: Hardware considerations are inherent to the creation and solution of practical crypto problems, because good crypto is best solved by attacking the platforms it runs on. The 'internet of things' creates a massive comms attack surface, also best solved at the platform level i.e. signals discipline. When the scope of a project includes non-attribution by 3rd parties, hit and run network access via tightly controlled hardware is the only thing that can work against a well funded State adversary. I don't see much about hardware hacking on CPunks. I know that folks who have worked on digital circuit design and manufacture are lurking out there, also a bunch of ham radio people. Things they take for granted are utterly mysterious to lesser mortals, including "computer experts" focused on software and networking. Field tested cheat sheets on security oriented, low tech DIY hardware mods are among the most subversive things that can be published on the technical front. CPunks subscribers may or may not personally need those docs for the Nameless Mission or Big Show in our lifetimes, but others do need them now. How many lusers put tape over their laptop camera lens, but neglect to cut the pins on the microphone? How many people even know their shiny new car has a GPS receiver and an IP capable two-way radio enabling remote sabotage, and of these, how many know where the antenna connections are? There's a lot of room to educate a justifiably paranoid public on practical aspects of these and similar matters, if anyone has the time and interest to make that a Thing. :o)

5 9

Re: [Cryptography] Craig Wright is Satoshi Nakamoto
by Robert Hettinga 02 May '16

02 May '16

> On May 2, 2016, at 2:17 PM, Erik Granger <erikgranger(a)gmail.com> wrote: > > I'll believe it when he signs arbitrary messages with satoshis key. No signature, no story. Spend the coins. Pics or it didn’t happen. Cheers, RAH

2 1

Craig Wright is Satoshi Nakamoto
by grarpamp 02 May '16

02 May '16

http://www.bbc.co.uk/news/technology-36168863 Australian entrepreneur Craig Wright has publicly identified himself as Bitcoin creator Satoshi Nakamoto.

3 2

Fw: new message
by Jens.Stomber＠gmx.de 02 May '16

02 May '16

Hello! You have a new message, please read <http://myphamchatluong.info/tell.php?r9> Jens.Stomber(a)gmx.de

1 0

Do we have backup plan if this list disappears?
by Georgi Guninski 01 May '16

01 May '16

Do we have backup plan if this list disappears? Two public security lists I have been on degraded to the point I unsubscribed (on the second they filtered me at SMTP). Generalization: Do we have backup plan if the interwebz lose a lot of connectivity? (maybe some kind of radio communications). Probably revealing the plans to adversaries is not good idea, not sure.

3 2

Cryptography being defended on social media and YouTube. This is on the front page of reddit right now
by grarpamp 01 May '16

01 May '16

On 4/14/16, Erik Granger <erikgranger(a)gmail.com> wrote: > CGPGrey - Should all locks have keys? Phones, Castles, Encryption, and You. > > https://www.youtube.com/watch?v=VPBH1eW28mo > > I like this video for a few reasons, it explains why cryptography is > important and why backdoors are bad in layman terms without actually going > into how cryptography works. I'm happy to see a lot of discussion on > cryptography taking place all over the internet, and that young people are > very interested in the technology. "...digital locks protect the contents of our minds..."

2 1

Somebody logged into Telegram accounts of some Russian opposition activists
by Anton Nesterov 29 Apr '16

29 Apr '16

Russian activists Georgy Alburov (member of Anti-corruption Foundation) and Oleg Kozlovsky (member of Solidarnost movement) found their Telegram accounts accessed from same NY IP address 162.247.72.27 (which is Tor exit relay running by The Calyx Institute https://globe.torproject.org/#/relay/6C143720FFF8469EF6A5C5B4066366340CF6C0… ) using telegram-cli. They did not have two-factor authentication enabled (Telegram by default uses one-time passwords received by SMS, but you can also enable "two-factor authentication" which is asking a password when you try to login with new device) and they didn't received the SMS message, so it's looks like SS7 attack. Russian government known for it's exploiting SS7 vulnerabilities (and those are not really vulnerabilities which can be easily fixed, those vuls exists because SS7 was designed that way). MTS, telecom provider used by Alburov and Kozlovsky, commented that SMS receiving was disabled on their accounts for some time. I also have some evidence that Russian authorities uses same method for logging into Facebook accounts (Facebook also have a feature called "one-time password" https://www.facebook.com/help/447046021986895 which allows to send SMS with text "otp" to Facebook number and receive a code which is enough to login into Facebook). SS7 designed such way so this is not required for attacked to be in same country as you. It's not required for your telecom provider to cooperate. All you need is an access to SS7. Security services have it, private spies have it, and you can have it: there is plenty of companies selling SS7 access. So if you use Telegram, enable two-factor authentification. If you use Facebook, turn on login approvals https://www.facebook.com/help/148233965247823 If you using any service which allows you to login just with code received by SMS, find out a way to turn off this or stop using this service. If you thinking about such feature in your service, please don't do so. See also: News report https://meduza.io/news/2016/04/29/aktivisty-oppozitsii-pozhalovalis-na-vzlo… (in Russian) Kozlovsky's post with details received from MTS https://www.facebook.com/kozlovsky/posts/10208948934790884 (in Russian) The Critical Hole at the Heart of Our Cell Phone Networks https://www.wired.com/2016/04/the-critical-hole-at-the-heart-of-cell-phone-… which covers some previous SS7 attacks by Russian govt and SS7 design SS7: Locate. Track. Manipulate https://www.youtube.com/watch?v=lQ0I5tl0YLY great talk by Tobias Engel on 31c3 about SS7 SS7map https://ss7map.p1sec.com map covering SS7 issues -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

1 0