- cypherpunks - lists.cpunks.org

Re: Ethical Tor
by Ryan Carboni 12 Nov '15

12 Nov '15

> On 11/11/2015 12:27 PM, Ryan Carboni wrote: > >* https://blog.torproject.org/blog/ethical-tor-research-guidelines <https://blog.torproject.org/blog/ethical-tor-research-guidelines> > *> >* Interesting problem: to use Tor is to say you trust your ISP less than > *>* some pseudorandom person over the internet. > * > Sadly enough, that's often prudent. Some ISPs are honorable, for sure. > But many are duplicitous scum. > > In any case, it's more accurate to say that about your VPN provider. > With Tor, you're trusting the system, but system integrity is resilient > to malicious nodes. So you're not trusting any one of them fully, even > your entry guard, as much as you would have been trusting your ISP. > > Correct, it would be prudent to avoid using port 80 over Tor for anything personally identifiable. http://motherboard.vice.com/read/court-docs-show-a-university-helped-fbi-bu…

5 7

2 WikiLeaks questions
by Douglas Lucas 12 Nov '15

12 Nov '15

1. It's not my theory, but what do you make of the theory that WikiLeaks would go under if it were not of the steady stream of celebrity endorsements (Lady Gaga, Pamela Anderson, many more)? Is hugely emphasized "soft power" a necessary component for a cabal out to change the world? Or could, say, a cabal demonstrate more independence and still be supported by enough people who do not need their hands held to the conclusion by Lady Gaga? 2. How could/should an organization with more than two million followers tweet in order to improve the world? Could it give the public specific, actionable instructions for overthrowing governments and corporations? They might have to be less specific, so as not to qualify as threats that would get the account closed. But the account could massively amplify the instructions to the public given by victims such as Doctors Without Borders. Or it could organize boycotts of private spy firms such as Stratfor. What do you think? People who care about branding might argue that such tweets wouldn't fit WikiLeaks' brand, but things can be easily framed as freedom of the press/speech or crytography--e.g., something like Israel's attacks on Gaza: you can't publish accounts of injuctice with Tor when bombed to death.

1 0

New functionality of Facebook
by Tomas Overdrive Petru 12 Nov '15

12 Nov '15

I know nobody will like this, because mood is fck Facebook here, but I like this small step as example: Just by accident I have found Facebook have text field in settings where you can insert your public key and after confirmation email communication between your inbox and Facebook will be encrypted. Update your info -> contact and Basic Info -> PGP Public Key Regards, - Over -- “Borders I have never seen one. But I have heard they exist in the minds of some people.” ― Thor Heyerdahl Telegram...................@over23 facebook...................facebook.com/overdrive23 projects...................https://brmlab.cz/user/overdrive twitter....................https://twitter.com/#!/over2393 last.fm....................http://www.last.fm/user/overdrive23 GnuPG key FingerPrint......08EA E4DC EF85 0F02 9267 5B48 2E58 6902 C5F8 794C Public key ................http://overdrive.dronezone.eu/overdrive.txt

3 2

Australia's human rights application to the United Nations Human Rights Council
by Zenaan Harkness 12 Nov '15

12 Nov '15

Australia wants an illustrious seat on this body self tasked with being "responsible for the promotion and protection of all human rights around the globe": http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11543178 http://www.ohchr.org/en/hrbodies/hrc/pages/hrcindex.aspx With Saudi Arabia heading up part of the United Nations Human Rights Council: https://en.wikipedia.org/wiki/United_Nations_Human_Rights_Council#Saudi_Ara… , Australia should fit right in. Bloody ratbags, whitewashing (but only sanctioned) genocide around the planet. No wonder Australia wants to join. Zenaan

1 0

Ethical Tor
by Ryan Carboni 12 Nov '15

12 Nov '15

https://blog.torproject.org/blog/ethical-tor-research-guidelines Interesting problem: to use Tor is to say you trust your ISP less than some pseudorandom person over the internet.

3 2

Re: [Cryptography] Cryptogit
by grarpamp 11 Nov '15

11 Nov '15

On Wed, Nov 11, 2015 at 4:27 AM, Markus Wanner <markus(a)bluegap.ch> wrote: > On 11/10/2015 08:45 AM, grarpamp wrote: >> PKI built in, that may serve as a idea / base for further encryption work... > does not support encryption of data. I meant further crypto work to include encryption.

1 0

UK To Demand Backdooring Else Prison [Crypto In Devices, Email And More]
by grarpamp 11 Nov '15

11 Nov '15

http://arstechnica.co.uk/tech-policy/2015/11/snoopers-charter-uk-govt-can-d… Buried in the 300 pages of the draft Investigatory Powers Bill (aka the Snooper's Charter), published on Wednesday, is something called a "technical capability notice" (Section 189). Despite its neutral-sounding name, this gives the UK's home secretary almost unlimited power to impose "an obligation on any relevant operators"—any obligation—subject to the requirement that "the Secretary of State considers it is reasonable to do so." There is also the proviso that "it is (and remains) practicable for those relevant operators to comply with those requirements," which probably rules out breaking end-to-end encryption, but would still allow the home secretary to demand that companies add backdoors to their software and equipment. That's bad enough, but George Danezis, an associate professor in security and privacy engineering at University College London, points out that the Snooper's Charter is actually much, much worse.

2 2

PGP, Mail, Devices, P2P, Bans, Utility [was: UK Crypto]
by grarpamp 11 Nov '15

11 Nov '15

> Its easier to make a slick UI than convince people to do work. Is it > so much to ask that people who make software try to make life easy for > their users? Apple understands and successfully applies that. They put their UX and code camps together. It's something open source coders should solicit more into their fold... open source UX'ers. Assuming for example that Apple's phone crypto really is as good as their word, then the only real weakness is whatever cheesy screenpass it takes to login, yet so long as you *can* enter a strong 128 bit, insert a cryptokey, whatever... then it services everyone well enough. > You can drive a car mostly successfully without too much information but > if it stops at the side of the road and the limited info from your dials > doesn't tell you what's wrong then a bit more knowledge might just get > you home. > If anything, this matches the Enigmail model more than the invisible > crypto model. Sure, level based access to more details and knobs is fine. Dummy Mode, Medium Mucking, and Advanced Footshooting > - Your key gets signed by your friends, so now your friend network public > - Emails with PGP are provably from you, in a way that can be traced > back to physically witnessed government ID. Then don't have your key signed, and or be a nym and sign those of nyms you trust based on context, not on govts. Use of WOT is an option there if you want it, not every use case of PGP needs it. > PGP as a *product* it was a complete failure. I mean, it > doesn't even protect metadata. No, PGP is excellent, at what it does. Like any other tool, it fails when people foolishly try to make it do what it can't in situations it shouldn't. There is no blame on the tool there, only upon the people stubbornly bashing their head trying to make it fit. Continuing to talk about traditional SMTP transport services as fixable by bolting on whatever... is futile, ignorant, and old. All the people circlejerking on Metzdowd about designing crypto fixes into existing SMTP models, and all the newfangled encrypted webmail providers fall into that category. > the metadata issue a big problem for everyone who connects to a > server that isn't owned by them and I suspect really requires a new mail > protocol to resolve. Owning both ends hides the non-body elements, but you're not hiding dns lookups, sizes, the fact that you hit send, etc. It's not a new mail protocol that's needed, it's a whole new messaging network. > the only option is to make GPG transparent by getting the > email providers to automatically create key pairs and automatically > handle signing and encryption by integrating their mail services with > GPG behind the scenes. No, this is a non option. - Free providers are out for their own, like govts, they have no real interest in their users going dark. - Paid providers are a bit more loyal, but building that and making statements about it entails risk of suit for failure such that they're not really inclined. Most of them can't even put postfix, dovecot and openldap together reliably and scalably, let alone functional spam control and peering. - You're still trusting your keys to the provider, and that the provider won't be forced to jack you through your browser or whatever cool software they give you. In today's world, that is an abject failure. As before: Traditional centralized messaging services are a failure. There is NOTHING you can do to fix them but to replace them. That is where you have the chance to integrate crypto and defenses. And the only valid thing to replace them with now against the risk of centralization and all but godlike attack is a new anonymous encrypted P2P messaging transport system that scales [1]. You could create a new UI on all the platforms, and for faster adoption encapsulate existing message format within and extend existing clients to deal with the cryptographic addressbooking and keep it Unix and business needs pipeliney. You could include storage and nym registration. But at minimum you need to shuffle messages between cryptographic endpoints within the net. Anyways, you're wasting your time talking about PGPifying webmail, desnooping and delogging SMTP, and poor little Johnny. Forget about that tired old refit shit and build something new. Put a little bling and sound effects in it, call it an IM, it worked for ICQ and Candy Crush. The users will come, trust me. Do it soon so you can try to head off bans with your newfound embedded ubiquity. [1] We have a handful of researched and implemented systems now. But don't yet have enough knowledge, experience and wisdom to determine what really should go into one that will remain valid for the next 30 years of relatively stable internet API as we know it [2]. There's a good rate of people deploying new p2p, crypto, anti-metadata, attack resistant, network tech such that by 2020 we may have explored enough areas to begin to feel confident in assembling a handful of them into such a system... even into a number of systems... messaging, storage, info / data distribution, payments. But it will take all of us trying them out and contributing to do it. [2] Packet switched IPv6 routed global end to end connectivity. https://en.wikipedia.org/wiki/Internet https://en.wikipedia.org/wiki/History_of_the_Internet

1 0

Re: FOIA MuckRock API
by coderman 11 Nov '15

11 Nov '15

On 11/10/15, Michael Morisy <m(a)morisy.com> wrote: > I don't, for me it crashed around page 40 when I had it doing 20 > requests a page, but good chance I was doing something dumb/it was a > problem with my computer comparing Python versions might be useful. (i am using 2.7.6 for this test) > Mitch wrote some export code that's much cleaner in case it's helpful, > with the big caveat that it drops everything into JSON files instead > of txt and PDF. thanks; i'm past 90 pages now, and wondering if this is a particular edge case with some specific versions of Python, urllib, requests - the whole crew are a motley bunch! last question: API only credentials, like a "Device Login" or API token, which don't use primary username and password: are these on the roadmap? i don't mind this method much, since i generate unique user and passwords anyway, but it is good practice to have separate credentials for the bots and scripts :) thanks again!

1 0

FOIA MuckRock API
by Michael Best 11 Nov '15

11 Nov '15

I've been in on-and-off contact with Michael Morisy over at MuckRock, and one of the things that's come up is the API script that they're working on the export the FOIA requests and responses. Unfortunately, the script crashes after processing a few dozen, but not consistently - likely the result of character encoding issues. He's given me permission to share the in-progress script. https://github.com/MuckRock/API-examples/blob/master/export_all_requests_as… If anyone is able to look at the code and offer any ideas about solutions (or even pinpointing the problem), it'd be a great public service. I'm not code savvy enough to help, but I'm hoping someone on the list can bring in some fresh eyes and help MuckRock get the script working. --Mike

2 2