- cypherpunks - lists.cpunks.org

Audit of TrueCrypt
by Eugen Leitl 10 Oct '13

10 Oct '13

----- Forwarded message from taxakis <taxakis(a)gmail.com> ----- Date: Thu, 10 Oct 2013 10:37:08 +0200 From: taxakis <taxakis(a)gmail.com> To: cryptome(a)freelists.org Cc: 'Eugen Leitl' <eugen(a)leitl.org> Subject: Audit of TrueCrypt Message-ID: <000c01cec593$e83d29f0$b8b77dd0$@com> X-Mailer: Microsoft Office Outlook 12.0 http://www.fundfill.com/fund/4-spzFJdDQk211KJDAUfcOw==# If sharing this link, please use http://fundfill.com/fund/TrueCryptAudited A working draft of our rules is at http://istruecryptauditedyet.com. Stay tuned, and follow #istruecryptauditedyet on twitter. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[liberationtech] FW: [bestbits] Rousseff & Chehade: Brazil will host world event on Internet governance in 2014
by Eugen Leitl 10 Oct '13

10 Oct '13

----- Forwarded message from michael gurstein <gurstein(a)gmail.com> ----- Date: Wed, 9 Oct 2013 15:12:22 -0700 From: michael gurstein <gurstein(a)gmail.com> To: liberationtech <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] FW: [bestbits] Rousseff & Chehade: Brazil will host world event on Internet governance in 2014 Message-ID: <0f4501cec53c$a90304a0$fb090de0$(a)gmail.com> X-Mailer: Microsoft Outlook 14.0 Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> A very very important post-Snowden development. Bravo to Brazil (and Chehade)! M Bestbits.net [mailto:bestbits-request@lists.bestbits.net] On Behalf Of Carlos A. Afonso Sent: Wednesday, October 09, 2013 2:46 PM To: Civil Society Internet Governance Caucus - IGC; NCSG List; BestBits List Subject: [bestbits] Rousseff & Chehade: Brazil will host world event on Internet governance in 2014 [sorry for possible duplicate posts] Dear people Here is the Google Translate English version (I did some editing) of the official report on the meeting between President Rousseff and ICANN's President and CEO Fadi Chehadé, which just happened. The original version in Brazilian Portuguese is at the end. fraternal regards --c.a. http://convergenciadigital.uol.com.br/cgi/cgilua.exe/sys/start.htm?infoid=35 107&sid=4&utm_source=twitterfeed&utm_medium=twitter#.UlXEbbOm1q8 Brazil will host world event on Internet governance >From the editor :: Convergência Digital :: 09/10/2013 Brazil will host the meeting in 2014 to discuss the necessary changes to Internet governance. After meeting with the president of the Internet Corporation for Assigned Names and Numbers (Icann, its acronym in English), Fadi Chehadé, President Dilma Rousseff agreed to meet global leaders from different sectors interested in the topic. According to Chehadé, the world counts on Brazil's leadership on this issue, after President Dilma Rousseff spoke at the opening of the 68th UN General Assembly, held in September in the United States. "The world heard the Brazilian president, who spoke with deep conviction, with great courage, and expressed the frustration that many people around the world feel about the fact that the trust relationship we have with the Internet had been broken,"said, revealing that the speech by Dilma was the motivation of his proposal for their meeting. Chehadé cited allegations of espionage involving the communication of Brazilian authorities and citizens, among them the very president, Petrobras and the Ministry of Mines and Energy. "I came to ask the president to elevate her leadership to a new level, to ensure that we can all get together around a new model of governance in which all are equal," he said. The president of Icann said that future decisions on how leaders can manage the internet should be based on the principles of the Civil Rights Framework for the Internet in Brazil which is going through the National Congress. Fadi Chehadé was yesterday (Oct.7th) with Communications Minister Paulo Bernardo, to ask for help from Brazil to start discussions about changes in the governance of the Internet, and said that the arrangements should begin this year. According to him, the need for a new governing body of the Internet requires the involvement of multiple actors, not just the government. "I understand that the internet has a new feature that requires active participation by governments, their respective agencies within the United Nations, but also in the context of users, civil society, the technicians, who after all make the Internet work," Chehadé defended. For the president of the corporation, academics and industrialists need to participate in the debate, as they reflect on rights and carry out the management of the Internet infrastructure. The president of Icann said telecommunications companies must also attend the conference."They are integral part of the family with which we must work," he said. According to Paulo Bernardo, President Dilma agreed that changes in network governance must occur multilaterally and with the participation of all actors who engage the internet, and said that "we must not allow economic, political and religious interests to interfere in the free circulation of ideas." The minister said that the suggestion of the president is that the event be held in April 2014 in Rio de Janeiro. Source : Agência Brazil -------- original in pt-br ------------- O Brasil vai sediar em 2014 o encontro para discutir as mudanças necessárias para a governança da internet. Após se encontrar com o presidente da Corporação da Internet para Atribuição de Nomes e Números (Icann, na sigla em inglês), Fadi Chehadé, a presidenta Dilma Rousseff concordou em reunir líderes globais de diferentes setores interessados no tema. De acordo com Chehadé, o mundo conta com a liderança brasileira nesta questão, depois que a Presidenta Dilma Rousseff discursou na abertura da 68ª Assembleia Geral da ONU, ocorrida em setembro nos Estados Unidos. O mundo ouviu a Presidenta brasileira, que falou com profunda convicção, com muita coragem, e externou a frustração que muitas pessoas, em todo mundo, sentiam com o fato de que a confiança havia sido quebrada que temos com relação à internet, disse, revelando que o discurso de Dilma foi a motivação da sua proposta para o encontro. Chehadé citou as denúncias de espionagem envolvendo a comunicação de autoridades e cidadãos brasileiros, dentre eles a própria presidenta, a Petrobras e o Ministério de Minas e Energia. Vim solicitar à presidenta que elevasse sua liderança a um novo nível, de modo a assegurar que todos possamos nos reunir em torno de um novo modelo de governança, em que todos sejamos iguais, afirmou. O presidente da Icann disse que as futuras decisões sobre como os líderes poderão gerir a internet devem ter como base os princípios do marco civil brasileiro, que tramita no Congresso Nacional. Fadi Chehadé esteve anteontem (7) com o ministro das Comunicações, Paulo Bernardo, a fim de pedir ajuda do Brasil para iniciar os debates sobre mudanças na governança da internet, e disse que as articulações devem começar este ano. Segundo ele, a necessidade de um novo órgão gestor da internet passa pela participação de múltiplos atores, não só do governo. Entendo que a internet tem um novo recurso, que exige participação ativa por parte dos governos, dos seus respectivos órgãos no âmbito das Nações Unidas, mas também no âmbito dos usuários, da sociedade civil, dos técnicos, que afinal de contas fazem a internet funcionar, defendeu Chehadé. Para o presidente da corporação, os acadêmicos e industriais precisam participar do debate, pois refletem sobre o direito e fazem a gestão da infraestrutura da internet. O presidente da Icann disse que as empresas de telecomunicações devem também participar da conferência. Elas são parte integrante da família com a qual precisamos trabalhar, afirmou. Segundo Paulo Bernardo, a presidenta Dilma concordou que as mudanças na governança da rede devem ocorrer de forma multilateral e com a participação de todos os atores que se envolvem a internet, e disse que não se pode permitir que interesses econômicos, políticos e religiosos interfiram na livre circulação das ideias. O ministro informou que a sugestão da presidenta é que o evento ocorra em abril de 2014 no Rio de Janeiro. fonte: Agência Brasil -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

re: NSA data centre power surges & unknowns...
by brian carroll 10 Oct '13

10 Oct '13

Lodewijk andré de la porte <l(a)odewijk.nl> wrote: > The massive quantum computer has unpredictable power consumption. Lee Azzarello <lee(a)guardianproject.info> wrote: > I guess inventing new math to break crypto has some physics problems. these comments has me contemplating what a large-scale networked quantum computer installation would involve.. and to what extent the image of racks of servers may note correlate with the computing technology inside the boxes, or in some percentage of the data centre. in other words- how would a quantum installation differ from the classical computer systems of the last many decades- would they be of yet another smaller scale or would an installation inherently be enormous. what if the data centre was all quantum computing in terms of the data throughput - do these numbers correlate or are different approaches to security calculations required is it possible that a 'computer within a computer' could exist, such that a quantum chip could be embedded and use a classical electronic based system, that is, some form of stealth or hidden computing that occurs in a parallel hidden framework, including for networking data. could ethernet or fibre channel be used or would it need to be different, say tuned resonant circuits computing in other dimensionality. would such an installation be possible and be manageable via secondary, zoned interface, and not noticeable, especially if sealed into processors or chips and thus tamper- and inspection-proof. to what extent may the data centre be a Spruce Goose or Glomar Explorer, providing conventional 'economies-of-scale' development for computing that is beyond this present-day technological situation. the idea that the NSA would field an early quantum computer in such a situation seems unlikely. especially if considering the scale issue whereby early computing starts large and shrinks down, thus ENIAC or other room or warehouse sized earlier computer installations of newly developing technology eventually moving into transistor and integrated circuit (IC) fabrications, personal computing, server boxes instead of tape-storage mainframes, and now cellphones compared to peak computing power thirty or more years earlier. would quantum computers require different storage technology, for instance, or could they rely on today's storage- or would it need to be formatted differently. and given massive parallelism and the nature of supercomputers to be custom programmed and time-shared by various projects, could such a quantum device exist nested in another system yet be linked in parallel to make a massive installation, and then be called upon for particular vexing tasks versus number crunching or data processing that can effectively be managed via existing tech, such as voice recognition or text analysis in particular modeling approaches. i wonder if - and perhaps it is entirely wrong-minded - in some way -- besides the issue of batteries as a limit upon scale and usability of computing resources, that if the electron itself is a false-limit and there could be smaller particle flows harnessed via destabilizing the natural equilibrium and thus the imbalance forces movement of charge at a smaller scale or within a different kind of circuitry that could be nested inside a larger electronic installation. what if a quantum computer would be equivalent to a tiny unmarked IC on a circuitboard and yet would it require access to the same components of existing computer architectures today or could it operate beyond or outside this, say as a connectable linked quantum processor networked into parallelism, for calculations alone. would a quantum computer installation be humongous or could a sufficiently developed (say, over the last 50 years) quantum computer be the size of a PC today yet wield teraflop or beyond capacity. what would be a telltale sign of such computing. could it involve strange or aberrant electronic or electrical interference or events, is it possible that the flow of electrons may interfere with such computation or that such a computer may need to be isolated else it could force strange current backwards, beyond diode barricades even, given weirdness of the physics. would the power draw be the same or more or less. would existing parallel software approaches even be viable within such a context or is it reliant upon assumptions that no longer apply if one or more foundations of existing computer architectures are changed or made unnecessary. is a quantum computer only quantum in some senses, such as processing, and this stops at I/O or other supposed 'motherboard' interactions, or would the entire circuit be changed. could there be hybrids where both co-exist, or like questioned, if one computing system could be embedded within another, via protected boundary? (this is already assumed for tech today, though seemingly in the same realm of technology in the mundane sense, like masquerade processing or other mystery functionality) the assumption i think is most likely if such a scenario existed would be that any such quantum technology would be highly advanced from the rudimentary first stages it exists today in the commercial realm, and would be possible to deploy and crack crypto en masse and that there is not symmetry between AES256 and this giant installation- built just for that- and instead whatever capacity were to exist it would be so far beyond the requirements of existing crypto as to provide decades of headroom for more data crunching atop what exists to be parsed and analyzed, catalogued, and stored in terms of record keeping. that it would involve 'big picture' data modeling of the state itself in its many and various dimensions as they are correlated- or perhaps that is only the domain of the underground data centres, who knows. in other words: can the assumption be made that the image of rows upon rows of computing servers equal 'traditional computing power' or might they function as the signage for conventional technology when stealth computing infrastructure could be within the mystery boxes networked and sparking. is it conventional for such feedback upon large scale installations or could such aberrations or anomalies indicate other possibilities, as commented. is there some truth to the irreverence, in that would anyone in the public know or be able to know, or even in government or private service - unless vetted and kept out of the mainstream, and its venue of conventional technological development. could quantum computing exist over the existing internet and be unrecognized or would it require its own parallel infrastructure. would the equivalent of a non-stealth advanced quantum computer installation be at the same scale or, if unhidden, potentially much smaller, else indicate anything if the existing installation was entirely or a large percentage of quantum computers. what would it mean for crypto, for instance. would emissions or anything else provide indication of quantum versus traditional computing architectures, via escaped signature forms of data structuring tuned into remotely. what would it mean, otherwise. (i put these things here at the bottom to make space for the post, there is no extra line break at the end, so the list footer often crunches the last line of text. even if fixed/added i may include an ASCII character anyway, for issues of symbolism as it relates to code and processing) xp

1 0

Re: [Cryptography] Iran and murder
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Phillip Hallam-Baker <hallam(a)gmail.com> ----- Date: Wed, 9 Oct 2013 08:44:05 -0400 From: Phillip Hallam-Baker <hallam(a)gmail.com> To: Tim Newsham <tim.newsham(a)gmail.com> Cc: John Kelsey <crypto.jmk(a)gmail.com>, "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com>, "James A. Donald" <jamesd(a)echeque.com> Subject: Re: [Cryptography] Iran and murder Message-ID: <CAMm+LwiYZfYAYU_r97B3WhWjbgSr8=W7-rC5HWHRCY3+p9qRfw(a)mail.gmail.com> On Wed, Oct 9, 2013 at 12:44 AM, Tim Newsham <tim.newsham(a)gmail.com> wrote: > > We are more vulnerable to widespread acceptance of these bad principles > than > > almost anyone, ultimately, But doing all these things has won larger > budgets > > and temporary successes for specific people and agencies today, whereas > > the costs of all this will land on us all in the future. > > The same could be (and has been) said about offensive cyber warfare. > I said the same thing in the launch issue of cyber-defense. Unfortunately the editor took it into his head to conflate inventing the HTTP referer field etc. with rather more and so I can't point people at the article as they refuse to correct it. I see cyber-sabotage as being similar to use of chemical or biological weapons: It is going to be banned because the military consequences fall far short of being decisive, are unpredictable and the barriers to entry are low. STUXNET has been relaunched with different payloads countless times. So we are throwing stones the other side can throw back with greater force. We have a big problem in crypto because we cannot now be sure that the help received from the US government in the past has been well intentioned or not. And so a great deal of time is being wasted right now (though we will waste orders of magnitude more of their time). At the moment we have a bunch of generals and contractors telling us that we must spend billions on the ability to attack China's power system in case they attack ours. If we accept that project then we can't share technology that might help them defend their power system which cripples our ability to defend our own. So a purely hypothetical attack promoted for the personal enrichment of a few makes us less secure, not safer. And the power systems are open to attack by sufficiently motivated individuals. The sophistication of STUXNET lay in its ability to discriminate the intended target from others. The opponents we face simply don't care about collateral damage. So I am not impressed by people boasting about the ability of some country (not an ally of my country BTW) to perform targeted murder overlooks the fact that they can and likely will retaliate with indiscriminate murder in return. I bet people are less fond of drones when they start to realize other countries have them as well. Lets just stick to defense and make the NATO civilian infrastructure secure against cyber attack regardless of what making that technology public might do for what some people insist we should consider enemies. -- Website: http://hallambaker.com/ _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Secrecy News -- 10/08/13
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Steven Aftergood <saftergood(a)fas.org> ----- Date: Tue, 08 Oct 2013 08:59:10 -0700 From: Steven Aftergood <saftergood(a)fas.org> To: eugen(a)leitl.org Subject: Secrecy News -- 10/08/13 Message-ID: <181be29e41961c44cc8cf25aaf148cf5(a)lists.fas.org> Reply-To: saftergood(a)fas.org X-Mailer-LID: 1 X-Mailer-RecptId: 399049 X-Mailer-SID: 1881 X-Mailer-Sent-By: 2 Format Note: If you cannot easily read the text below, or you prefer to receive Secrecy News in another format, please reply to this email to let us know. SECRECY NEWS from the FAS Project on Government Secrecy Volume 2013, Issue No. 87 October 8, 2013 Secrecy News Blog: http://blogs.fas.org/secrecy/ ** CIA HALTS PUBLIC ACCESS TO OPEN SOURCE SERVICE CIA HALTS PUBLIC ACCESS TO OPEN SOURCE SERVICE For more than half a century, the public has been able to access a wealth of information collected by U.S. intelligence from unclassified, open sources around the world. At the end of this year, the Central Intelligence Agency will terminate that access. The U.S. intelligence community's Open Source Center (OSC), which is managed by the CIA, will cease to provide its information feed to the publicly accessible World News Connection as of December 31, 2013, according to an announcement from the National Technical Information Service (NTIS), which operates the World News Connection (WNC). The WNC "is an online news service, only accessible via the World Wide Web, that offers an extensive array of translated and English-language news and information," an NTIS brochure explains. "Particularly effective in its coverage of local media sources, WNC provides you with the power to identify what really is happening in a specific country or region. Compiled from thousands of non-U.S. media sources, the information in WNC covers significant socioeconomic, political, scientific, technical, and environmental issues and events." "The information is obtained from full text and summaries of newspaper articles, conference proceedings, television and radio broadcasts, periodicals, and non-classified technical reports. New information is entered into WNC every government business day. Generally, new information is available within 48-72 hours from the time of original publication or broadcast." "For over 60 years, analysts from OSC's domestic and overseas bureaus have monitored timely and pertinent open-source materials, including grey literature. Uniquely, WNC allows you to take advantage of the intelligence gathering experience of OSC," the NTIS brochure says. Soon, that will no longer be true. http://www.ntis.gov/products/wnc.aspx The WNC public feed from the Open Source Center is a highly attenuated version of what is available to official government users. Within government, copyright considerations are ignored, but for public distribution they must be respected, and so (with some exceptions) only information products whose creators have signed a royalty agreement with NTIS are publicly released. Even with that significant limitation and the attendant public subscription fees, the NTIS World News Connection has remained a highly prized resource for news reporters, foreign policy analysts, students and interested members of the public. I check it almost every day. Recently, for example, I have been following official statements from Russian officials who allege that the U.S. is covertly developing biological weapons for use against Russia in a military laboratory in the Republic of Georgia. The claim seems bizarre, but may nevertheless be politically significant. Detailed English-language coverage of the matter, or of many other stories of regional interest and importance, is not readily available elsewhere. (Moreso than in the past, however, portions of the material that is publicly accessible through WNC can be obtained elsewhere, through other news services or foreign websites.) The reasons for the decision to terminate the World News Connection are a bit obscure. Producing it is not a drain on U.S. intelligence-- the marginal costs of providing the additional feed to NTIS are close to zero. (The total budget for open source intelligence was about $384 million in FY2012, according to classified budget records obtained by the Washington Post from Edward Snowden.) However, the program is a headache for NTIS to manage, particularly since NTIS officials had to negotiate numerous contracts with media source providers to offer their products to the public. But the large majority of that work has already been accomplished, and now it will be rendered useless. Mary Webster of the Open Source Center had initially proposed to cancel the public information feed as of September 30, according to an NTIS official. Then she was persuaded to grant a six month reprieve. But in the end, a cut-off date of December 31, 2013 was set. If that comes to pass, it will be a blow to researchers and proponents of public intelligence. The Federation of American Scientists had previously argued that the U.S. government should actually expand public access to open source intelligence by publishing all unclassified, uncopyrighted Open Source Center products. ("Open Up Open Source Intelligence," Secrecy News, August 24, 2011.) Instead, even the current range of publications will no longer be systematically released. (Only a small fraction of publicly unreleased OSC records ever seem to leak.) http://blogs.fas.org/secrecy/2011/08/open_up_osint/ Although the Open Source Center is managed by the Central Intelligence Agency, it is formally a component of the Office of the Director of National Intelligence. Yet the move the terminate public access to OSC products seemed to catch the ODNI unawares. "Obviously our attention is on a possible lapse in appropriations, but we are looking into this," said an ODNI spokesman on September 30, just before the government shutdown. "The information provided through NTIS makes an irreplaceable contribution to U.S. national security," wrote Prof. Gary G. Sick of Columbia University in an October 1999 letter, in response to a previous proposal to curtail coverage in the World News Connection. The World News Connection "informs us about other countries in ways that otherwise would be nearly impossible," Dr. Sick wrote. "It costs virtually nothing in comparison with almost any other national security system. It is not as sexy as a bomber or a missile, but its contributions to national security can be attested to by generations of policy-makers. I was in the White House during the Iranian revolution and the hostage crisis, and my respect for the power of this information was born at that time. I often found it more helpful than the reams of classified material that came across my desk at the NSC." http://www.fas.org/irp/fbis/sicklet.html _______________________________________________ Secrecy News is written by Steven Aftergood and published by the Federation of American Scientists. The Secrecy News Blog is at: http://www.fas.org/blog/secrecy/ To SUBSCRIBE to Secrecy News, go to: http://blogs.fas.org/secrecy/subscribe/ To UNSUBSCRIBE, go to http://blogs.fas.org/secrecy/unsubscribe/ OR email your request to saftergood(a)fas.org Secrecy News is archived at: http://www.fas.org/sgp/news/secrecy/index.html Support the FAS Project on Government Secrecy with a donation: https://members.fas.org/donate _______________________ Steven Aftergood Project on Government Secrecy Federation of American Scientists web: www.fas.org/sgp/index.html email: saftergood(a)fas.org voice: (202) 454-4691 twitter: @saftergood ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [tor-talk] Tor Weekly News — October 9th, 2013
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Joe Btfsplk <joebtfsplk(a)gmx.com> ----- Date: Wed, 09 Oct 2013 12:41:04 -0500 From: Joe Btfsplk <joebtfsplk(a)gmx.com> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] Tor Weekly News — October 9th, 2013 Message-ID: <52559530.1060502(a)gmx.com> User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 Reply-To: tor-talk(a)lists.torproject.org On 10/9/2013 10:27 AM, Lunar wrote: > ======================================================================== > Tor Weekly News October 9th, 2013 > ======================================================================== > > Welcome to the fifteenth issue of Tor Weekly News, the weekly newsletter > that covers what's happening in the world of Tor — “king of high-secure, > low-latency anonymity” [1]. > > [1] http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… > > New tranche of NSA/GCHQ Tor documents released > ---------------------------------------------- > > ... a series of stories were published > in the Guardian and the Washington Post that detailed alleged attempts > by NSA, GCHQ, and their allies to defeat or circumvent the protection > that Tor offers its users. ... > > The documents in question [3] offer,... a summary of > attacks against Tor users and the network as a whole that they have > considered or carried out. > I'm sure Tor developers have considered the real possibility that some or all of what different agencies release, about their capabilities & successes (or lack of) against Tor - or anything else, is misinformation, designed to make the Tor Project AND users more comfortable in continuing to use TBB. Logically, if any agency or adversary divulged they can somewhat successfully track users or "infiltrate the system," then most would stop using it and a valuable method to gather information or catch "criminals" would cease to exist. Good poker players and gov'ts NEVER reveal their hands. I wouldn't take seriously anything that ANY gov't publicly reveals about their technology or intelligence capability (or lack there or). Over a long history, it's been repeatedly shown that advanced gov'ts always know more & have more technology capability, than is revealed. That is, often until decades later, when the real truth comes out. It's no different now. -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[liberationtech] The Unintended Consequences of Internet Diffusion: Evidence from Malaysia - CDDRL
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Yosem Companys <companys(a)stanford.edu> ----- Date: Wed, 09 Oct 2013 10:01:52 -0700 (PDT) From: Yosem Companys <companys(a)stanford.edu> To: Liberation Technologies <liberationtech(a)lists.stanford.edu> Subject: [liberationtech] The Unintended Consequences of Internet Diffusion: Evidence from Malaysia - CDDRL Message-ID: <20130929032139.14625.98397@domU-12-31-39-0A-A0-4F> Reply-To: liberationtech <liberationtech(a)lists.stanford.edu> http://cddrl.stanford.edu/events/7900 The Unintended Consequences of Internet Diffusion: Evidence from Malaysia Program on Liberation Technology Seminar Series DATE AND TIME October 10, 2013 4:30 PM - 6:00 PM AVAILABILITY Open to the public No RSVP required SPEAKER Luke Miner - Data Scientist at Stanford University Abstract: Can the introduction of the Internet undermine incumbent power in a semi-authoritarian regime? I examine this question using evidence from Malaysia, where the incumbent coalition lost its 40-year monopoly on power in 2008. I develop a novel methodology for measuring Internet penetration, matching IP addresses with physical locations, and apply it to the 2004 to 2008 period in Malaysia. Using distance to the backbone to instrument for endogenous Internet penetration, I find that areas with higher Internet penetration experience higher voter turnout and higher candidate turnover, with the Internet accounting for one-third of the 11% swing against the incumbent party in 2008. The results suggest that, in the absence of the Internet, the opposition would not have achieved its historic upset in the 2008 elections. Luke Miner is a recent Ph.D. in Economics from the London School of Economics. He was also a postdoctoral fellowship at the Center on Democracy, Development and the Rule of Law (CDDRL) in the Liberation Technology program. He is currently working as a data scientist in the tech sector. Miner’s research interests are political economy and development economics. In particular, he aims to quantitatively assess the effect of the Internet and new media on political accountability, development, and election outcomes. His past research finds a strong effect of Internet diffusion on results of Malaysia's 2008 elections, where it contributed to the ruling coalition's largest electoral setback in thirty years. His current research looks at the effect of the Internet on the 2008 US presidential elections, in particular as a means of promoting campaign contributions. LOCATION Wallenberg Theater Wallenberg Hall 450 Serra Mall, Building 160 Stanford, Ca 94305-2055 -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others?
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Jim Thompson <jim(a)netgate.com> ----- Date: Wed, 9 Oct 2013 18:38:50 +0200 From: Jim Thompson <jim(a)netgate.com> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others? Message-Id: <CA528C57-0280-4175-B2D0-C5A92C79976D(a)netgate.com> X-Mailer: Apple Mail (2.1812) Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> Exactly, although this rule doesn’t just apply to “small companies”. Big companies have shown to just roll over and give up the customer’s data. So asking the question is stupid(*), because a lie is indistinguishable from the truth. No, the NSA hasn’t approached us about pfSense, or adding a “back door”, or anything similar. Nor has anyone else. The next step is yours. I am told that the NSA did review a version of pfSense that was made for a customer which would filter SCADA protocols. I can’t verify that or not. Note also that someone DID once accuse OpenBSD of having a problem with it’s IPSEC processing, which Theo *vehemently* denied. http://www.informationweek.com/security/vulnerabilities/openbsd-founder-bel… http://marc.info/?l=openbsd-tech&m=129236621626462&w=2 Sam Leffler, about four years earlier, found a bug in the AH processing, which he fixed (in FreeBSD) and handed back to the OpenBSD. They patched same, but never gave any acknowledgement to Sam. So, maybe you should run OpenBSD. Jim * as it turns our, yes, Samantha, there is a Santa Clause^W^W^W^Ware stupid questions. On Oct 9, 2013, at 6:22 PM, Walter Parker <walterp(a)gmail.com> wrote: > The big problem with asking the question "Has the NSA required you to add a back door?" is that no small company that wants to say in business can or will say yes (If they do, no one will trust/use the product unless forced themselves). The company will agree/be forced to say no. How does one tell that no from an authentic no? > > Therefore, once trust is question, the only way to be sure is to do the self review suggested earlier... > > However, from my perspective, the code in pfSense is more like to be secure than any commercial, closed source solution. See prior threads about FreeBSD security. > > > Walter > > > On Wed, Oct 9, 2013 at 9:10 AM, Thinker Rix <thinkerix(a)rocketmail.com> wrote: > On 2013-10-09 19:03, Jim Thompson wrote: > (TIC mode: on) > Sorry, but I guess the whole matter - not only concerning pfSense, but the current threat to our civilization by our criminal governments as a whole - is much too serious for any "TIC-modes".. > > _______________________________________________ > List mailing list > List(a)lists.pfsense.org > http://lists.pfsense.org/mailman/listinfo/list > > > > -- > The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis > _______________________________________________ > List mailing list > List(a)lists.pfsense.org > http://lists.pfsense.org/mailman/listinfo/list _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others?
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Jim Pingle <lists(a)pingle.org> ----- Date: Wed, 09 Oct 2013 11:59:51 -0400 From: Jim Pingle <lists(a)pingle.org> To: pfSense support and discussion <list(a)lists.pfsense.org> Subject: Re: [pfSense] NSA: Is pfSense infiltrated by "big brother" NSA or others? Message-ID: <52557D77.6000504(a)pingle.org> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 Reply-To: pfSense support and discussion <list(a)lists.pfsense.org> On 10/9/2013 11:20 AM, Paul Kunicki wrote: > I think that in light of the recent news of the NSA coercing various > organizations to provide them with means to eavesdrop this message has > merit and deserves response although I doubt the NSA really needs > cooperation from these guys. Does anyone else care to comment ? As far as I'm aware, nobody has contacted us, but if they did I may not know. They aren't really interested in end-user firewalls, they want infrastructure routers. We had a discussion on this already a month ago. http://lists.pfsense.org/pipermail/list/2013-September/004543.html Our code is all open source. In addition to our own code, code is also pulled from places such as FreeBSD, OpenSSL, and so on. So while our code is clean, it might be possible that if something we depend on has a flaw (perhaps by design in an encryption algorithm...) then it might be carried over. Nothing intentional on our part, and if such a thing is discovered and the offending code is fixed, we'd pull it in ASAP. So it would be more interesting to focus on FreeBSD, OpenSSL, OpenVPN, racoon, and other similar projects upon which we depend. Jim _______________________________________________ List mailing list List(a)lists.pfsense.org http://lists.pfsense.org/mailman/listinfo/list ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[tor-talk] Tor Weekly News — October 9th, 2013
by Eugen Leitl 09 Oct '13

09 Oct '13

----- Forwarded message from Lunar <lunar(a)torproject.org> ----- Date: Wed, 9 Oct 2013 17:27:02 +0200 From: Lunar <lunar(a)torproject.org> To: tor-news(a)lists.torproject.org, tor-talk(a)lists.torproject.org Subject: [tor-talk] Tor Weekly News — October 9th, 2013 Message-ID: <20131009152702.GA17748@loar> User-Agent: Mutt/1.5.21 (2010-09-15) Reply-To: tor-talk(a)lists.torproject.org ======================================================================== Tor Weekly News October 9th, 2013 ======================================================================== Welcome to the fifteenth issue of Tor Weekly News, the weekly newsletter that covers what's happening in the world of Tor — “king of high-secure, low-latency anonymity” [1]. [1] http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… New tranche of NSA/GCHQ Tor documents released ---------------------------------------------- After a cameo appearance in previous leaked intelligence documents [2], Tor found itself at the center of attention in the latest installment of the ongoing Snowden disclosures after a series of stories were published in the Guardian and the Washington Post that detailed alleged attempts by NSA, GCHQ, and their allies to defeat or circumvent the protection that Tor offers its users. A number of source materials, redacted by the newspapers, were published to accompany the articles. The documents in question [3] offer, alongside characteristically entertaining illustrations [4], an overview of the Tor network from the point of view of the intelligence agencies, as well as a summary of attacks against Tor users and the network as a whole that they have considered or carried out. Despite the understandable concern provoked among users by these disclosures, Tor developers themselves were encouraged by the often relatively basic or out-of-date nature of the attacks described. In response to one journalist's request for comment, Roger Dingledine wrote that “we still have a lot of work to do to make Tor both safe and usable, but we don't have any new work based on these slides” [5]. Have a look at the documents yourself, and feel free to raise any questions with the community on the mailing lists or IRC channels. [2] https://blog.torproject.org/blog/tor-nsa-gchq-and-quick-ant-speculation [3] http://media.encrypted.cc/files/nsa [4] https://twitter.com/EFF/status/386291345301581825 [5] https://blog.torproject.org/blog/yes-we-know-about-guardian-article#comment… tor 0.2.5.1-alpha is out ------------------------ Roger Dingledine announced [6] the first alpha release in the tor 0.2.5.x series, which among many other improvements introduces experimental support for syscall sandboxing on Linux, as well as statistics reporting for pluggable transports usage on compatible bridges. Roger warned that “this is the first alpha release in a new series, so expect there to be bugs. Users who would rather test out a more stable branch should stay with 0.2.4.x for now.” 0.2.5.1-alpha will not immediately appear on the main download pages, in order to avoid having too many versions listed at once. Please feel free to test the new release [7], and report any bugs you find! [6] https://lists.torproject.org/pipermail/tor-talk/2013-October/030269.html [7] https://www.torproject.org/dist/ How did Tor achieve reproducible builds? ---------------------------------------- At the end of June, Mike Perry announced [8] the first release of the Tor Browser Bundle 3.0 alpha series, featuring release binaries “exactly reproducible from the source code by anyone”. In a subsequent blog post [9] published in August, he explained why it mattered. Mike has just published the promised follow-up piece [10] describing how this feat was achieved in the new Tor Browser Bundle build process. He explains how Gitian [11] is used to create a reproducible build environment, the tools used to produce cross-platform binaries for Windows and OS X from a Linux environment, and several issues that prevented the builds from being entirely deterministic. The latter range from timestamps to file ordering differences when looking up a directory, with an added 3 bytes of pure mystery. There is more work to be done to “prevent the adversary from compromising the (substantially weaker) Ubuntu build and packaging processes” currently used for the toolchain. Mike also wrote about making the build of the compiler and toolchain part of the build process, cross-compilation between multiple architectures, and the work being done by Linux distributions to produce deterministic builds from their packages. If you are interested in helping, or working on your own software project, there is a lot to be learned by reading the blog post in full. [8] https://blog.torproject.org/blog/tor-browser-bundle-30alpha2-released [9] https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and… [10] https://blog.torproject.org/blog/deterministic-builds-part-two-technical-de… [11] http://gitian.org/howto.html Toward a new Tor Instant Messaging Bundle ----------------------------------------- A first meeting last week kicked-off the “Attentive Otter project” [12] which aims to come up with a new bundle for instant messaging. The first meeting mainly consisted in trying to enumerate the various options. In the end, people volunteered to research three different implementation ideas. Thijs Alkemade and Jurre van Bergen explored the possibilty of using Pidgin/libpurple [13] as the core component. Jurre also prepared an analysis of xmpp-client [14], together with David Goulet, Nick Mathewson, Arlo Breault, and George Kadianakis. As a third option, Mike Perry took a closer look at Instantbird/Thunderbird [15] with Sukhbir Singh. All the options have their pros and cons, and they will probably be discussed on the tor-dev mailing list and at the next “Attentive Otter” meeting. [12] https://trac.torproject.org/projects/tor/wiki/org/sponsors/Otter/Attentive [13] https://lists.torproject.org/pipermail/tor-dev/2013-October/005544.html [14] https://lists.torproject.org/pipermail/tor-dev/2013-October/005546.html [15] https://lists.torproject.org/pipermail/tor-dev/2013-October/005555.html More monthly status reports for September 2013 ---------------------------------------------- The wave of regular monthly reports from Tor project members continued this week with submissions from George Kadianakis [16], Lunar [17], Sathyanarayanan Gunasekaran [18], Ximin Luo [19], Matt Pagan [20], Pearl Crescent [21], Colin C. [22], Arlo Breault [23], Karsten Loesing [24], Jason Tsai [25], the Tor help desk [26], Sukhbir Singh [27], Nick Mathewson [28], Mike Perry [29], Andrew Lewman [30], Aaron G [31], and the Tails folks [32]. [16] https://lists.torproject.org/pipermail/tor-reports/2013-October/000346.html [17] https://lists.torproject.org/pipermail/tor-reports/2013-October/000347.html [18] https://lists.torproject.org/pipermail/tor-reports/2013-October/000348.html [19] https://lists.torproject.org/pipermail/tor-reports/2013-October/000349.html [20] https://lists.torproject.org/pipermail/tor-reports/2013-October/000350.html [21] https://lists.torproject.org/pipermail/tor-reports/2013-October/000351.html [22] https://lists.torproject.org/pipermail/tor-reports/2013-October/000352.html [23] https://lists.torproject.org/pipermail/tor-reports/2013-October/000353.html [24] https://lists.torproject.org/pipermail/tor-reports/2013-October/000354.html [25] https://lists.torproject.org/pipermail/tor-reports/2013-October/000355.html [26] https://lists.torproject.org/pipermail/tor-reports/2013-October/000356.html [27] https://lists.torproject.org/pipermail/tor-reports/2013-October/000357.html [28] https://lists.torproject.org/pipermail/tor-reports/2013-October/000358.html [29] https://lists.torproject.org/pipermail/tor-reports/2013-October/000359.html [30] https://lists.torproject.org/pipermail/tor-reports/2013-October/000360.html [31] https://lists.torproject.org/pipermail/tor-reports/2013-October/000361.html [32] https://lists.torproject.org/pipermail/tor-reports/2013-October/000362.html Tor Help Desk Roundup --------------------- A number of users wanted to know if Tor was still safe to use given the recent news that Tor users have been targeted by the NSA. We directed these users to the Tor Project's official statement on the subject [33]. One of the most popular questions the help desk receives continues to be whether or not Tor is available on iOS devices. Currently there is no officially supported solution, although more than one project has been presented [34, 35]. The United Kingdom is now one of the countries where citizens request assistance circumventing a national firewall [36]. [33] https://blog.torproject.org/blog/yes-we-know-about-guardian-article [34] https://lists.torproject.org/pipermail/tor-dev/2013-October/005542.html [35] https://trac.torproject.org/projects/tor/ticket/8933 [36] https://lists.torproject.org/pipermail/tor-talk/2013-July/029054.html Miscellaneous news ------------------ Thanks to Grozdan [37], Simon Gattner from Netzkonstrukt Berlin [38], Wollomatic [39], and Haskell [40] for setting up new mirrors of the Tor project website. [37] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000366.ht… [38] https://lists.torproject.org/pipermail/tor-mirrors/2013-September/000370.ht… [39] https://lists.torproject.org/pipermail/tor-mirrors/2013-October/000374.html [40] https://lists.torproject.org/pipermail/tor-mirrors/2013-October/000375.html Arlo Breault sent out a request for comments on a possible new version of the check.torproject.org page [41]. [41] https://lists.torproject.org/pipermail/tor-talk/2013-October/030253.html Runa Sandvik announced [42] that the Tor Stack Exchange page has moved from private beta to public beta. If you'd like to help answer Tor-related questions (or ask them), get involved now! [43] [42] https://lists.torproject.org/pipermail/tor-talk/2013-October/030269.html [43] http://tor.stackexchange.com/ Philipp Winter sent out a call for testing (and installation instructions) for the ScrambleSuit pluggable transports protocol [44]. [44] https://lists.torproject.org/pipermail/tor-talk/2013-October/030252.html Not strictly Tor-related, but Mike Perry started an interesting discussion [45] about the “web of trust” system, as found in OpenPGP. The discussion was also held on the MonkeySphere mailing list, which prompted Daniel Kahn Gilmor to reply with many clarifications regarding the various properties and processes of the current implementation. To sum it up, Ximin Luo started [46] a new documentation project [47] “to describe and explain security issues relating to identity, in (hopefully) simple and non-implementation-specific language”. [45] https://lists.torproject.org/pipermail/tor-talk/2013-September/030235.html [46] https://lists.riseup.net/www/arc/monkeysphere/2013-10/msg00000.html [47] https://github.com/infinity0/idsec/ The listmaster role has been better defined [48] and is now performed by a team consisting of Andrew Lewman, Damian Johnson, and Karsten Loesing. Thanks to them! [48] https://trac.torproject.org/projects/tor/wiki/org/operations/Infrastructure… Roger Dingledine released an official statement on the Tor project blog [49] regarding the takedown of the Silk Road hidden service and the arrest of its alleged operator. [49] https://blog.torproject.org/blog/tor-and-silk-road-takedown Fabio Pietrosanti asked [50] for reviews of “experimental Tor performance tuning for a Tor2web node.” Feel free to have a look [51] and provide feedback. [50] https://lists.torproject.org/pipermail/tor-talk/2013-October/030405.html [51] https://github.com/globaleaks/Tor2web-3.0/wiki/Performance-tuning Claudiu-Vlad Ursache announced [52] the initial release of CPAProxy [53], “a thin Objective-C wrapper around Tor”. This is the first component of a project to “release a free open-source browser on the App Store that uses this wrapper and Tor to anonymize requests.” Claudiu-Vlad left several questions open, and solicited opinions on the larger goal. [52] https://lists.torproject.org/pipermail/tor-dev/2013-October/005545.html [53] https://github.com/ursachec/CPAProxy Upcoming events --------------- Oct 09-10 | Andrew speaking at Secure Poland 2013 | Warszawa, Poland | http://www.secure.edu.pl/ | Oct 11 | Kelley @ Journalist Training Event | Helsiniki, Finland | http://www.journalistiliitto.fi/jp13/ | Nov 04-05 | 20th ACM Conference on Computer and Communications Security | Berlin, Germany | http://www.sigsac.org/ccs/CCS2013/ This issue of Tor Weekly News has been assembled by Lunar, harmony, dope457 and Matt Pagan. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [54], write down your name and subscribe to the team mailing list [55] if you want to get involved! [54] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [55] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0