- cypherpunks - lists.cpunks.org

Re: [tor-talk] Cicada 3301: 2016
by grarpamp 17 Feb '16

17 Feb '16

On 2/11/16, Green Dream <greendream848(a)gmail.com> wrote: >> I'm surprised anyone thinks this could possibly be anything besides a > viral >> marketing campaign. AR games are all the rage these days. > > > That doesn't make a lot of sense to me. Cicada_3301 is going on 5 years. > Seeing as no entity has stepped forward, there is no marketing benefit. For > that matter there's no tangible benefit for the sponsor at all, aside from > possibly attracting talent. Agreed. If they were selling auto insurance, they'd look pathetic, especially to those working it. It's bragging rights / talent search / comrade at arms. Whether from Big Govt, Big Corp, or cpunks. Those who solved one or more know the answer... :)

2 1

Suggestion: Don't reply onlist to known spies and national security employees
by Georgi Guninski 17 Feb '16

17 Feb '16

Basically I am suggesting "don't feed the trolls", but this would be an insult to trolls (IMHO troll is not always bad). So I suggest: Don't reply onlist to known spies and national security employees. This might hurt their plans and/or salaries.

4 5

FOIPA Adventures
by Ryan Carboni 17 Feb '16

17 Feb '16

Since there seems to be a competition to make embarrassing FOIA requests to the government: "I request the audio of the last Challenger shuttle mission. The privacy interests since the New York Times v. NASA suit has diminished, particularly after it was widely reported that they were still alive and trapped within the shuttle. There remains a public interest in knowing exactly when the astronauts died." "I request records prepared for the 01-27-16 press conference regarding Malheur Wildwife Refuge. Greg Bretzing, SAC of the FBI Portland Field Office, made a statement that the occupiers were outsiders, while wearing a wind breaker. I infer that the statement was made based on advice from the Behavioral Analysis Unit. The fact that the BAU assists in Media Strategies has been publicly acknowledged in books by former FBI agents and on federal government websites. The law enforcement exemption can only be applied in limited circumstances with specificity, such as a specific investigation. There is also a public interest in knowing how the government is crafting messages for public consumption." "I request statistics from 2001 to 2015 estimating the number of individuals who have lost their security clearance because it was discovered through a polygraph that they are not comfortable with their work (including, but not limited to, a moral, ethical, or emotional comfort). I believe that the DNI centrally compiles this or has authority over this data." I find it disturbing that Ginsberg's opinion that "vocal inflections" (screaming) have a privacy interest.

1 0

Ideals in crypto: Apple must help Feds unlock San Bernardino killer's iPhone – judge
by Georgi Guninski 17 Feb '16

17 Feb '16

http://www.theregister.co.uk/2016/02/17/apple_help_fbi_san_bernardino/ ==== Apple must assist the FBI in unlocking the passcode-protected encrypted iPhone belonging to one of the San Bernardino shooters in California. ... It’s technically possible for Apple to hack a device’s PIN, wipe, and other functions. Question is can they be legally forced to hack," said iOS security expert Jonathan Ździarski. ==== Remember the NSA key on windoze? ;)

4 5

De-dollarization possibly about to snowball
by Zenaan Harkness 17 Feb '16

17 Feb '16

The article below presents thoughts that seem overly simplistic to me, being not based much in facts such as the recent awareness that Iran is now selling its oil in Euros: http://russia-insider.com/en/politics/iran-dumps-petrodollar-wants-euros-al… (Oh dear, sorry Saddam Hussein, you just weren't a big enough fish, and you were put in place by the CIA, so you should have been a little cleverer, or waited 20 years, to sell your oil in Euros.) and Rupees: http://russia-insider.com/en/its-happening-iran-india-dump-petrodollar-sett… and the consequent rise (last two/three weeks) in the price of gold by about $150 an ounce - here in Australia, gold normally changes price inversely to our currency's price wrt USDollar - but last Thursday, our dollar went UP one cent, and gold ALSO went up (instead of down), in the order of $100. This is rare. Yes, when the game shifts, there is a run away from fiat currency into precious metals, in particular gold. We've seen this historically too (great depression). Just because there's not enough gold don't mean a bee's dick of nothing - that just means that the final fall back currency (gold and silver) have a run on them and the price skyrockets. Let's see if the gold price march continues this week and next - if so, it's likely to skyrocket IMHO ... Of course we already know that Russia is settling with China in Yuan/Renminbi, although I don't recall the price of gold going up when that happened - probably because the USA has had so much pressure on Russia (Ukraine, sanctions, Syria, media disinfo), but now with India, and now Iran, and the whole Saudi/shale-oil (and against rest of the world) price war, well perhaps it's starting to get real enough that the hedge funds are starting to say "oh shit!" Viva la change! ---- http://russia-insider.com/en/no-virginia-trading-oil-other-currencies-wont-… " No, Virginia, Trading Oil in Other Currencies Won't Kill the Dollar America doesn’t care what color electrons you use Jacob Dreizin Subscribe to Jacob Dreizin 5 hours ago | 801 Comments Donate! This is the only way to really "kill the dollar." Don't try this at home There are good reasons for doing certain cross-border trade in your own currency, or that of your trade partner. Consider that all digital dollar transactions across borders, anywhere on this planet, have to go through one or more U.S. banks. And if Uncle Sam doesn't like you, well, he can just cut you off from that. No more foreign trade for you! It happened to Iran in 2012, forcing the country to survive on a bizarre gas-for-gold scheme with Turkey, complete with a "gold express" on passenger flights from Dubai to Tehran. Russia was also threatened with something roughly along these lines in 2014. Thus, the main benefit of using non-dollar currencies in your foreign trade: You're not as vulnerable to the whims of Uncle Sam. And for countries on the outs with the Uncle, that's very important. But that's it. Folks who claim that “de-dollarization” in the oil trade—or any other trade—will “kill the dollar” (or something like that), don't ever explain how. Sure, it sounds good, but what is the mechanism of action? Answer: There is none. Because, today, demand for the dollar isn’t based simply on the convenience of using it to settle accounts across borders. Or more precisely, that’s part of it, but by no means the root of it. The dollar is convenient because every country and major bank has some. In other words, demand for the dollar is based on its status as the global reserve currency. And its status as the global reserve currency is due to the massive, highly-liquid market for U.S. Treasury bonds. And the massive, highly-liquid market for U.S. Treasury bonds owes its existence to: (1) The USA's unique position of running perpetual, large, unrestrained budget deficits, while (2) maintaining its ability to pay off the debt issued to cover those deficits by issuing more debt perpetually, while (3) the world needs somewhere to stuff its trillions in cash (to include trillions of dollars earned by running large, perpetual trade surpluses with the USA.) Because, after all, a foreign central bank holding cash dollars wouldn't be able to pay itself a return, and as for potential large depositors, your national deposit insurance scheme only guarantees accounts up to some trivial amount. Whereas the USA can print dollars and thus, guarantees all of its bonds. Does this sound like a confidence scheme? Hell yeah! But what are you going to do about it? That is, if (hypothetically) everyone suddenly lost confidence in the USA's ability to pay its debts without inordinately debasing its currency... ...Where else could they put their money? You can't dump those trillions and trillions in your local non-U.S. bank. No one would guarantee it! Beyond some token amount, no state can guarantee deposits in a currency that it can't print itself. Nor is anyone yet prepared to guarantee the hypothetical equivalent of those dollars in local currency terms. Not to mention, the nature of double-entry accounting means banks would have to immediately loan that money out or put it on deposit with their Central Bank—which creates its own set of problems. So all those folks who chant “there will be a run from the dollar” should think about what they're saying. Moreover, they should ask themselves: A "run" into what, exactly? What would the nations and banks of the world convert their dollar reserves into? It can't be “rubles” or “yuan”, because that available volume of rubles or yuan (not debt instruments, but actual bank money to play around with) doesn't exist. The authorities would have to print mountains more rubles or yuan on the spot, crashing their value (and thus, paradoxically, supporting the dollar.) But more to the point in our debt-money system, that volume of ruble or yuan sovereign debt does not exist. Hence, saying “there will be a run from the dollar into (blank)”, ignores the fact that there's not enough (blank.) Not by a long shot. Not even if the dollar crashed 50 percent overnight against every other currency. But even if there was enough, your money-changer or bond dealer would have to take those dollars you're handing him, and put them somewhere! After all, he won't just throw them away. He has to eat, too. So where would they go? Into U.S. bonds! Thus reinforcing the dollar's status as the global reserve currency! So as you can see, a cataclysmic “run on the dollar” is impossible under the current system. Uncle Sam has this one locked down tight. As I explained here, it would take a total collapse of global finance to even begin to get the ball rolling away from dollar hegemony. And as I also explained here, the pain of such a collapse would be borne primarily by emerging markets like Russia, China, etc. And that's the last thing those countries want. So as long as the dollar remains the world's reserve currency, “de-dollarization” of the oil trade means nothing to the dollar. It's certainly a good idea for the countries involved. But America could care less. "

4 9

Re: [cryptome] Re: U.S. Hacked Into Iranâ€™s Critical Civilian Infrastr ucture For Massive Cyberattack
by Michael Best 17 Feb '16

17 Feb '16

If being "gov-friendly" is by itself enough to cast suspicion of bias, then the same should be assumed of all "gov-unfriendly" outlets. That's why it's important to look at the data. The source shouldn't be ignored, but analysis shouldn't begin and end with that. See also: https://en.wikipedia.org/wiki/Ad_hominem https://en.wikipedia.org/wiki/Poisoning_the_well On Tue, Feb 16, 2016 at 8:22 AM, John Young <jya(a)pipeline.com> wrote: > Maybe, maybe more cyberwar milking pretense. > > Gibney is a gov-friendly outlet. So is James Ball. > > > At 08:04 AM 2/16/2016, you wrote: > >> < >> http://www.buzzfeed.com/jamesball/us-hacked-into-irans-critical-civilian-in… >> > >> http://www.buzzfeed.com/jamesball/us-hacked-into-irans-critical-civilian-in… >> > > > >

3 2

FBI Exploits Tor vulnerabilities with NITS [Fwd: Posts from Just Security for 02/16/2016]
by Rayzer 17 Feb '16

17 Feb '16

-------- Forwarded Message -------- Today on Just Security for 02/16/2016 View this email in your browser (http://us7.campaign-archive2. com/?u=96b766fb1c8a55bbe9b0cdc21&id=03238ecdef&e=b84e639eaa) ** Law Enforcement Online: Innovative Doesn’t Mean Illegal (https://www.justsecurity.org/29364/law-enforcement-online-innovative-doesnt…) ------------------------------------------------------------ https://www.justsecurity.org/author/germanojudith/ Judith Germano (https://www.justsecurity.org/author/germanojudith/) Even the Wild West needed a sheriff. And today’s law enforcement agents, to be effective, need more than a Colt .45 and a gold star. Criminal actors have an increasing ability to commit serious crimes remotely via computers, while concealing their identity and location through the use of various means, including Tor hidden service protocols. To effectively identify and apprehend these criminals, law enforcement must be nimble and technologically savvy, and must employ regularly updated investigative tools. These tools include Network Investigative Techniques (NITs), which enable law enforcement (pursuant to court-authorized warrants) to identify the real IP address of web users, regardless of proxy settings. Some NITs also reveal users’ operating systems, CPU architecture, and session identification, and others (pursuant to a Title III or FISA warrant) can allow real-time, full-system monitoring. There has been some level of controversy recently regarding the FBI’s use of NITs. But as criminals evolve and become increasingly sophisticated through the use of Tor and encryption techniques, so too must law enforcement’s investigative measures evolve, provided they are employed in accordance with lawful procedures and adequate constitutional safeguards. It was through a NIT that the FBI, in 2015, was able to successfully take down one of the largest dark web child exploitation sites in the world, to apprehend child predators. The site, disturbingly named “Playpen,” provided thousands of pedophiles (http://www.scmagazine.com/staten-island-man-arrested-for-allegedly-possessi…) with images of horrifying sexual abuse of children, as well as guidance on how the molesters could avoid being detected. The Playpen site is reported to have had as many as 215,000 accounts within the first year, and an average of 11,000 unique visitors per week. The FBI, pursuant to a court order (http://arstechnica.com/tech-policy/2015/07/feds-bust-through-huge-tor-hidde…) , seized the web host server in North Carolina and, rather than shutting it down immediately, ran it under FBI control for a limited, two-week period. During that time, the FBI used a NIT, which exploited a security vulnerability in the Tor Browser Bundle, to identify more than 1,300 true IP addresses. More, see link at top.

1 0

Re: [cryptome] Re: [cryptography] Cryptome’s searing critique of Snowden Inc.
by Michael Best 16 Feb '16

16 Feb '16

Uh-oh, you're part of The Cabal now, coderman! On Mon, Feb 15, 2016 at 5:45 PM, coderman <coderman(a)gmail.com> wrote: > On 2/14/16, Malcolm Matalka <mmatalka(a)gmail.com> wrote: > >... > > Can you go into some detail on this? I was always under the impression > > that the Tor code was open source and heavily audited. Is the critique > > that this is not true or something else? > > > clarification in order. > > 1) government funding of Tor means they get dibs on development > priorities. censorship circumvention over dead-easy Tor Routers. > Translations in Tor Browser over endpoint-hardened solutions like > Whonix-Qubes around your Tor Browser. etc, etc. this does not imply > the Tor code itself is made vulnerable. For example, 8 hour patch on > control port vuln, and first to force disable RDRAND-sole-source in > OpenSSL. not the behavior of group at behest of NSA and IC... > > 2) critique of existing hardware and software in terms of strong > security against well resourced attackers. there is serious > vulnerability across the entire spectrum of technology. the assumption > that your malware laden WinXP box can run "Tor Browser" and be secure, > is laughable. we're finding more than ever that personal security, > operational security, and information security are all tied up in > complex interdependence. Tor doesn't even try to address this, because > frankly, no one has! it's the constantly evolving terrain of > specialized experts, long bought over to $Private or $Gov not Public > work. > > 3) Tor made trade-offs for end-user adoption and wide applicability. > we don't have have a fancy UDP Tor with traffic analysis resistance, > and some argue such a thing can't exist. this would be great to get > funded, but even past efforts have yielded detail around how much > remains to be researched, let alone implemented in proof-of-concept. > > > Tor well deserves their reputation for solid development in the public > interest, and their behavior regarding serious vulnerabilities is > exceptional across industry. actions above words, and they walk the > walk. i am also glad to see their first fund raiser to diversify > sources of support haul in hundreds of thousands for use without > strings attached. more of this! > > > best regards, > >

3 2

Re: U.S. Hacked Into Iranâs Critical Civilian Infrastr ucture For Massive Cyberattack
by John Young 16 Feb '16

16 Feb '16

Maybe, maybe more cyberwar milking pretense. Gibney is a gov-friendly outlet. So is James Ball. At 08:04 AM 2/16/2016, you wrote: ><http://www.buzzfeed.com/jamesball/us-hacked-into-irans-critical-civilian-in…>http://www.buzzfeed.com/jamesball/us-hacked-into-irans-critical-civilian-in… >

1 0

Sci-Hub: 'Pirate Bay for scientists'
by Александр 16 Feb '16

16 Feb '16

Sci-Hub: Russian neuroscientist running 'Pirate Bay for scientists' - with 48 million free academic papers - ... to remove all barriers in the way of science By Mary-Ann Russon - February 15, 2016 A website illegally offering academic papers for download is fighting back against a copyright infringement lawsuit in the US and has no intention of giving up Sci-Hub *knowledge to all* *We fight inequality in knowledge access across the world. The scientific knowledge should be available for every person regardless of their income, social status, geographical location and etc.* *Our mission is to remove any barrier which impeding the widest possible distribution of knowledge in human society!* Sci-Hub, a website dubbed the "Pirate Bay for scientists" by offering peer-reviewed academic papers to download for free, is thumbing its nose at copyright holders following an infringement lawsuit battle in the US. Sci-Hub <http://sci-hub.io/> is the brainchild of Alexandra Elbakyan, a neuroscientist from Kazakhstan who is now based in Russia. When she was writing her thesis in 2009, Elbakyan found it difficult to access the research she needed to complete her work, as she needed to download many papers, and each paper retailed for up to $30 (£21) each. To get through her thesis, Elbakyan was forced to download pirated versions of the academic papers for free, and eventually, after being introduced to a website that enabled researchers to share and trade the academic papers they needed with people who had paid for them, she decided to take the idea further and create her own website around 2011 or 2012. Tricking journals with university proxies Today, the Sci-Hub website boasts 48 million academic papers and has now gone viral, because it features technology similar to anonymising proxy websites. Rather than just enabling users to search for and extract the papers they need, the Sci-Hub website is programmed to automatically search for papers on important topics and work out how to download them to its database without spending a penny. Since various universities in the world have paid subscriber access to different premium journal services, the website is able to automatically trawl through different university proxies to trick the relevant journal's website into believing that the user accessing the academic paper has the relevant credentials similar to a paying customer. Once the paper is unlocked, Sci-Hub then downloads the paper to its database and even looks for other missing papers on similar topics to download, so that all the researcher has to do is initiate a search, and the paper will come up, ready to be downloaded for nothing. Apart from using Sci-Hub, the only way for researchers to gain access to research papers without paying for them is to ask people they know, or post on Twitter using the hashtag #Icanhazpdf <http://www.ibtimes.co.uk/i-can-haz-pdf-academics-tweet-secret-code-word-get…> . *Sued for copyright infringement and blocked in the US* At its peak in 2015, the website received 80,000 visitors a day, according to Nature magazine <http://www.nature.com/news/pirate-research-paper-sites-play-hide-and-seek-w…>, and had become so popular that academic publisher Elsevier <https://www.elsevier.com/> brought a copyright lawsuit against the website, claiming that it had lost between $75,000 - $150,000 in revenue due to the piracy. On 28 October 2015, a New York district court found in favour of Elsevier and placed a temporary injunction against Sci-Hub, as well as suspending access to the website's Sci-Hub.org domain, which has caused visitor numbers to drop to 30,000 a day. But other than that, not much else can be done to physically stop Elbakyan as she has no US assets to forfeit nor is she a US citizen, so, just like Pirate Bay's multiple domain names <http://www.ibtimes.co.uk/pirate-bay-seized-by-swedish-prosecutors-like-hydr…>, she quickly moved the website to Sci-Hub.io, where it continues to be freely accessible. "There should be no obstacles to accessing knowledge, I believe," Elbakyan told RT <https://www.rt.com/news/332412-scihub-scientific-articles-pirate/>. "[According to Article 27 of the United Nations Declaration of Human Rights], everyone has the right to freely participate in the cultural life of the community, to enjoy the arts and to share in scientific advancement and its benefits." Moving to the Dark Web Not only that, but Elbakyan has also moved Sci-Hub's servers onto the Dark Web – a section of the internet not discoverable by conventional means, such as through Google or other search engines or by directly entering a website URL. This is where cybercriminals typically list illegal goods and services like drugs, firearms and hackers-for-hire and using the Tor anonymity network <http://www.ibtimes.co.uk/snoopers-charter-why-arent-vpns-tor-mentioned-inve…> as a cloak to protect their real identities. Even better, there are a huge number of scientists in the world actively supporting Sci-Hub and even posting YouTube tutorials on how to download papers for free from <https://www.youtube.com/watch?v=YEDRMMZHjCo> the piracy portal, especially since revolting against Elsevier's high prices in 2012, with even Harvard University telling its staff that it could no longer afford the journal price hikes <https://www.theguardian.com/science/2012/apr/24/harvard-university-journal-…> in the same year. "Even if legal access to [Sci-Hub] is blocked, the user can still get in through the TOR network and immediately gain access to all the articles," said Elbakyan. "However, we intend to fight for free access to all information. After all, using TOR still provides obstacles." Read more about illegal downloading: - I can haz PDF: Academics tweet secret code word to get expensive research papers for free <http://www.ibtimes.co.uk/i-can-haz-pdf-academics-tweet-secret-code-word-get…> - Dallas Buyers Club: Australian judge refuses to unmask 4,726 alleged movie pirates <http://www.ibtimes.co.uk/dallas-buyers-club-australian-judge-refuses-unmask…> - US federal judge: IP address not enough to prove someone downloaded pirated movies <http://www.ibtimes.co.uk/us-federal-judge-ip-address-not-enough-prove-someo…> - People accused of online piracy win $450,000 from Warner Bros and Rightscorp in class action lawsuit <http://www.ibtimes.co.uk/people-accused-online-piracy-win-450000-warner-bro…> - My Little Pony Friendship Is Magic: Hasbro being sued for allegedly pirating brony font Generation B <http://www.ibtimes.co.uk/my-little-pony-friendship-magic-hasbro-being-sued-…>

2 1