- cypherpunks - lists.cpunks.org

UK's GCHQ and NCA: Joining Forces To Ferret Out Darknet
by grarpamp 11 Nov '15

11 Nov '15

http://motherboard.vice.com/read/the-uk-will-police-the-dark-web-with-a-new… The Joint Operations Cell will increase our ability to identify and stop serious criminals. The creation of this unit should finally shatter the image that GCHQ solely focuses on national security matters or terrorism cases. At the summit, it was said that GCHQ's technical skills would be its contribution to the unit. The JOC is a genuinely innovative development, using the best of our respective agencies' skills.

1 0

DropZone: An Anonymous Peer-To-Peer Local Contraband Marketplace
by grarpamp 10 Nov '15

10 Nov '15

https://github.com/17Q4MX2hmktmpuUKHFuoRmS5MfB5XPbhod To whom it may concern, Markets are objects of censorship and always have been. There is a presumed division, that renders commerce distinct from the notion of free speech. But I will allege that the act of commerce is, itself, indistinct from speech. Where or how one spends their value is a decision as personal and poignant as any words ever spoken or letters ever written. As a unfortunate consequence of freedom, bad actors will engage in repugnant trade that impinges upon the rights and freedoms of others. It is the job of humanity to cooperate and see to it that trade, such as this, becomes unprofitable. Whether it is accomplished through technological achievement or through the adjustment of social mores, or perhaps a simple appeal to the underlying natural law, it is not the job of bad acting third parties to force into hiding commerce that must be dealt with by means of an adjustment to the global, social conscience. Cooperation, in the manner I was just speaking about, has never been plausible until the invention of The Blockchain. I will not foist upon Satoshi's humble creation such impracticable possibilities as the achievement of world peace. But in approaching Drop Zone, I am attempting to do nothing more than what is possible and possibly more efficient than what exists. I wish for Drop Zone to be nothing more than an appendage to The Blockchain. As such, it is every bit as much Bitcoin as Bitcoin itself. Just as a fungible Bitcoin enables the exchange of spaceless value with near impunity, Drop Zone removes the ability of unwelcome parties from glancing over the shoulders of those in the act of an exchange, whatever it entails. This technology disrupts the ability of buyers to gain insight into the identities or movements of suppliers making supply chains far less vulnerable to disruption. It is this innovation that separates this project from all other decentralized market solutions. Whereas Bitcoin forces us to consider the nature of money and value, Drop Zone will do the same for commerce. At its root, Bitcoin is a message passing system. Those messages that are passed, unlike any electronic message that's come before it, articulate value. Commerce is, and has always been, similarly inclined toward message passing. Whether in-person, over email, or through large, online shopping carts, fundamentally, commerce is composed of messages that are in service of the transaction wherein a final message of value is sent to a recipient in exchange for a negotiated good or service. As such, Drop Zone is a secure message passing protocol inasmuch as it is a platform for commerce. And while the problem is far beyond the scope or capabilities of the protocol in its most fundamental form, the observant might even see the tenuous skeleton of a full-fledged reputation system. Such a project is, in itself, as important and difficult as any facing this decentralized ecosystem. I hope that Drop Zone lets us all dream of a day when no man will any longer be made to suffer indignity for simply engaging in unpopular or stigmatized commerce. May all commerce be created equal. Today is a Beautiful day, Miracle Max quia omnis qui se exaltat humiliabitur et qui se humiliat exaltabitur

1 1

Re: [FORGED] Re: [FORGED] Re: UK To Ban Crypto In Devices, Email And More
by oshwm 10 Nov '15

10 Nov '15

On 10/11/15 12:29, Neuhaus Stephan (neut) wrote: > On 2015-11-09 21:12, "oshwm" <oshwm(a)openmailbox.org> wrote: >> On 09/11/15 08:38, Neuhaus Stephan (neut) wrote: >>> On 2015-11-08 09:45, "cypherpunks on behalf of oshwm" >>> <cypherpunks-bounces(a)cpunks.org on behalf of oshwm(a)openmailbox.org> >>> wrote: >>> >>>> >>>> >>>> On 08/11/15 08:40, Peter Gutmann wrote: >>>>> oshwm <oshwm(a)openmailbox.org> writes: >>>>> >>>>>> Can GPG be easier to use, I think so, is it too difficult to use by >>>>>> ordinary >>>>>> people - no, they're just too fucking lazy and lack motivation. >>>>> >>>>> ... and this is pretty much the poster child for why we have so much >>>>> unusable >>>>> crypto today. >>>>> >>>> >>>> Or, why we have such a fucking retarded human race with the attention >>>> span of a knat who expect everything to be given to them on a plate. >>> >>> I think you're rather making Peter's point for him. >>> >>> Case in point: Would you care to try to explain to my dad (who is 76) >>> what >>> an expired PGP key means, exactly? What a trusted key is? Hell, what a >>> public key is, even? How a PGP plaintext signature could have failed to >>> verify? (In this context, don't forget to explain to him the difference >>> between UTF-8 and ISO 8859-1.) Hint: an attitude of "well, you just have >>> to learn all these new concepts, you fucking retarded human with the >>> attention span of a knat" is probably not going to help. >>> >> >> I feel sorry for your dad, having a child that thinks so little of his >> mental capacity. > > I guess that’s what I get for choosing an example that makes the > ad-hominem too easy. > You see, I didn't know what ad hominem mean't so I had a choice, I could wait for someone to explain it all to me or I could go and find out the meaning for myself - which I did :P >> If your dad can operate Windows and an email client then he has what is >> needed to learn enough to sign and encrypt emails with GnuPG. >> He doesn't need to know how crypto works or every minute detail, he just >> needs to be able to make sense of a Wizard and to be able to click a few >> buttons. > > I don’t think that’s true, and the reason is that it’s not enough to learn > the right sequence of buttons to press. You’re right: learning to press > some buttons in the right sequence is the easy part. The tricky part > happens when an error occurs, e.g., when a signature fails to verify. And > signatures can fail to verify for a huge number of reasons and an > Enigmail-style user interface will simply expose them to the user. > Without a correct mental model—which goes beyond knowing button > sequences—no one will be able to make a correct assessment of an error > situation, no matter what the age, education, or mental capacity. > >> He'll be at a disadvantage for not learning more about crypto and PGP >> but he'll be able to maintain a small amount of privacy in his use of >> email. > > Only when things go right. And only if he cares enough. If there was some > automated mechanism that would do all of these things automatically in the > background, he could be using encrypted email without even knowing it. > Like Skype, who at one time provided encrypted video and voice chat > without users even being aware. That did more for security than exposing > all the intricate details through an Enigmail-style UI. > Skype: centralized authentication by a third party corporation - you don't have to do any authentication for yourself, you just have to trust that Microsoft will never act in a way inconsistent with your privacy or freedom. PGP: decentralized authentication where the amount of trust you have in the certificates is fully under your control. But with this control comes complexity because you don't have some benevolent overlord taking care of your every need. Take your pick, personally I don't trust big corporations and for that reason will accept the extra complexity. >> When he gets stuck he might be able to ask his son or daughter for help > > He might indeed! Or he might not, given that his interest when interacting > with a computer is to e.g. send an email to someone, not to have to expend > work to preserve his privacy. I suspect that he’d rather go on with what > he was doing — sending email — than asking me what a good but untrusted > signature is. (For example.) > If he has little interest in protecting his privacy why would he even bother with any encryption no matter whether it's easy to use or not? >> - assuming he hasn't given up asking because you hold his mental >> capacity in such low regard. > > OK, next time, I’ll *really* choose another example that doesn’t open > myself up to the ad-hominem so easily. > Yep, use stereotypes and you get what you deserve :P >>> If we want "ordinary people” (whatever they are, but in a crypto context >>> they’ll be more like my dad than like me) to use encryption, we will >>> have >>> to make it invisible to them. It doesn't even have to be perfect; good >>> enough will do. >>> >> >> You think if crypto is invisible to people then they'll be able to deal >> with when things go wrong any better than your dad would be if you >> equipped him with minimal knowledge of how to get by with PGP using e.g >> Enigmail on Thunderbird? > > In most cases, yes. Also, it will enable things to go right more often, > simply because configuration options will be removed, making the whole > thing easier to write and test. > >> The more you hide details from people, the less they are able to help >> themselves. > > That is only true for a very small number of specialists. The success of > many products is precisely the careful hiding of many details, most of > which would be unintelligible to the vast majority of users anyway. Unless > you’re a trained engineer, you will have no detailed idea how a modern car > engine works (or FM radio or …), for example. If you had to know these > things in order to operate a car engine, there would be vastly fewer cars > out there. And common failure modes of cars — low fuel, low oil or tire > pressure and whatnot — have been incorporated into user interfaces that > many people routinely and correctly use. That works only by not exposing > details. > You can drive a car mostly successfully without too much information but if it stops at the side of the road and the limited info from your dials doesn't tell you what's wrong then a bit more knowledge might just get you home. If anything, this matches the Enigmail model more than the invisible crypto model. > Fun, > > Stephan > — > If I have downvote policy, I will downvote you. > >

1 0

Re: [Cryptography] Cryptogit
by grarpamp 10 Nov '15

10 Nov '15

On Mon, Nov 9, 2015 at 11:53 PM, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > As some folk will know from my facebook feed, I have been struggling > with git over the past week. > > With a considerable amount of hassle, I now have the systems running. > Its not pretty and there are good reasons for the usability horrors. > SSH and GIT both bump up against the PKI bootstrap problem when in > comes to sharing public keys. Fortunately that is the problem I am > currently working on and git is now one of the applications I hope to > make a lot easier to use with the Mesh. > > > Anyhoo. Let us imagine for a moment that it is really easy to connect > up to a git repo in the cloud. On your Google drive or your 1Tb > OneDrive or whatever. > > Wouldn't it be really nice to be able to automatically encrypt the > data you store in the remote .git repo? Interesting in the context of using git, particularly regarding multi-user use of same. Simply using a block storage provider would suffice to put a filesystem then git on top. There's another git-like version control system that has some PKI built in, that may serve as a idea / base for further encryption work... http://www.monotone.ca/ > It probably wouldn't be all that hard to arrange either. Just a few > extensions to the git file format to write out encryption headers into > each of the object files and encrypt the body. > > As folk have noted, proxy re-encryption 'recryption' can be used as > leverage to simplify the key management problem once a certain patent > expires in a couple of years. > > > Anyone interested?

1 0

TPP has provision banning requirements to transfer or access source code
by Zenaan Harkness 10 Nov '15

10 Nov '15

http://lwn.net/Articles/663817/ " Knowledge Ecology International looks at Article 14.17 of the Trans-Pacific Partnership (TPP), which has a provision banning requirements to transfer or provide access to software source code. "I'm wondering how the GPL fares here, and how much money Microsoft spent lobbying to get this included in the TPP, or if the NSA has a role in this. One aspect of this provision is that governments cannot insist on source code transparency, for mass market software, even to address concerns over security or interoperability."

2 1

Re: [FORGED] Re: [FORGED] Re: UK To Ban Crypto In Devices, Email And More
by oshwm 09 Nov '15

09 Nov '15

On 09/11/15 08:38, Neuhaus Stephan (neut) wrote: > On 2015-11-08 09:45, "cypherpunks on behalf of oshwm" > <cypherpunks-bounces(a)cpunks.org on behalf of oshwm(a)openmailbox.org> wrote: > >> >> >> On 08/11/15 08:40, Peter Gutmann wrote: >>> oshwm <oshwm(a)openmailbox.org> writes: >>> >>>> Can GPG be easier to use, I think so, is it too difficult to use by >>>> ordinary >>>> people - no, they're just too fucking lazy and lack motivation. >>> >>> ... and this is pretty much the poster child for why we have so much >>> unusable >>> crypto today. >>> >> >> Or, why we have such a fucking retarded human race with the attention >> span of a knat who expect everything to be given to them on a plate. > > I think you're rather making Peter's point for him. > > Case in point: Would you care to try to explain to my dad (who is 76) what > an expired PGP key means, exactly? What a trusted key is? Hell, what a > public key is, even? How a PGP plaintext signature could have failed to > verify? (In this context, don't forget to explain to him the difference > between UTF-8 and ISO 8859-1.) Hint: an attitude of "well, you just have > to learn all these new concepts, you fucking retarded human with the > attention span of a knat" is probably not going to help. > I feel sorry for your dad, having a child that thinks so little of his mental capacity. If your dad can operate Windows and an email client then he has what is needed to learn enough to sign and encrypt emails with GnuPG. He doesn't need to know how crypto works or every minute detail, he just needs to be able to make sense of a Wizard and to be able to click a few buttons. He'll be at a disadvantage for not learning more about crypto and PGP but he'll be able to maintain a small amount of privacy in his use of email. When he gets stuck he might be able to ask his son or daughter for help - assuming he hasn't given up asking because you hold his mental capacity in such low regard. > If we want "ordinary people” (whatever they are, but in a crypto context > they’ll be more like my dad than like me) to use encryption, we will have > to make it invisible to them. It doesn't even have to be perfect; good > enough will do. > You think if crypto is invisible to people then they'll be able to deal with when things go wrong any better than your dad would be if you equipped him with minimal knowledge of how to get by with PGP using e.g Enigmail on Thunderbird? The more you hide details from people, the less they are able to help themselves. > Fun, > > Stephan > — > > If I have downvote policy, I will downvote you. I'll take that as a compliment, thank you :) > >

2 2

Fwd: [cryptography] Introducing myself
by grarpamp 09 Nov '15

09 Nov '15

---------- Forwarded message ---------- From: <stenski(a)nymphet.paranoici.org> Date: Sun, Nov 8, 2015 at 8:06 PM Subject: [cryptography] Introducing myself To: cryptography(a)randombit.net -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My true name is the OpenPGP key whose public component is appended below. "Igor Stenski" is just a nickname. Each message from me is signed with this key. Interests include o zerocash [1]; and o bonded identity (a variant of fidelity bond [2]). bitcoin: 1JvAjr6DFg673Qy82n8WbWfdSYGmSZy1Jw [1] http://zerocash-project.org/ [2] http://en.bitcoin.it/wiki/Fidelity_bonds - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.12 (GNU/Linux) mQINBFYW2V0BEADVyNsPcBBHoM0ejwCDvF5KSCuc8ufCEemMhrIKQAhdu/QPMEEs b5xu/3r2C7rUOAxSlZLGWdgkQ2jA/XCjve4po3p+t1Gi1kNJB8n82XBnBy0qQVKP kacyl5JuUF76ihM1+UMD6Puq85/24fBD1OD/4T0HqOXAHVwU2ddiopDSNhD7te6l MeUJj2HFx882Y4756hRO6CzXpQI4+wiN2ehdZEMQo6gF1b9ccO0XAuu10isvoyu3 Ux3wIfDjJNbySAQdu8Z5QHKEdHaTkEQRPiKHsl5B8w2NB3EYPCwr/r1r78BxjH6m Rbju278dB+6lOc8sfyyOhVLuCtvBMl6Kih2D4wnuboB+bWI/jHfVgsq2mPakrGEc DVLOlYptAZlQOrTDDAd4pODZHHC/Iawr4y/8f9GUESHOTEuKxI0+xXNNxpabjGCd /mf08U+aGFYHVxhYNZFX06uhADfDz4zRyFlJcHrmeOIOIvOpC6P2MKgMXj7DYXfu VxPaBQrhu5XUPjyccvYDC0fsV+wHcTCdGa2c+6CLCkLUznQm4P+ShTaPrh0q2Ujs Y7wsxgeV018A76ndCFMbwKM806WMXgFJGyZsIMu2MhI/QmkTzqurH+ux+vdYKNRN 2bMO9GgXdcqUsHF5tWfYpHaRuSugmMO7yBDbaaiKD/mS1gJZThjADGgzzQARAQAB tCxJZ29yIFN0ZW5za2kgPHN0ZW5za2lAbnltcGhldC5wYXJhbm9pY2kub3JnPokC OAQTAQIAIgUCVhbZXQIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQVmjw A0F6imhVuQ/+OyBm8mPhDabJTmK+OBcVsH3vOO5dAB93QUaOdJEexv2GVl3rtKCP kix+ptyqQmmnYU9HQViRhVr+8kkyEjJhV4wZVrHlHa45st0jPOGqtCZTO6gjuSiD ZNK7YkUcxppDqYBZtocD5xIX/rn3e7Q6g0KhS0CP56rVBbf2iNetMQrBrxe3TigX UA1n0pA0LRM1d0Ekt3U01+Zr0lW8pz4Cdvo/MV5ZJ1w2NwezUs/fU8aIMBp3eGXu PVA7dqbmJhxv+D1HVSxn6gBPZpEefgOctpKGVmnEpoOTPOCJOcBY1Lb2zehHO3z7 4J1M9NlOQa1CyrmkfcanVxn38elRcLD8m6muBMZ+R8sSqY64mu7QVp0mwZ2wiZal 0kfy5Cgs8lsQ4hPbPAXas1wqGrA1DZ3c9JpJ7wXVCfQqlL4taVSNXucSutxN3VBA SfDpV4fwgQLqGBchPoy9+B8PCyy/XCEzlBMBUiUurFQX6XWNgWXz+h0P49tpegaZ q9hZLxlLHT8Gcu6ShYYI/FtoPLpd6vHktqmc8ckzDrlxl/aGq33fsTfkuZCZT5Ch FVFh/ojymgSjmkkzDb65C2LycIkhGh+mfLfefhW1i58Cp2vvNzoBojyeZivkfBn/ OkahsYisOeoH+/GKN3MAt4o4qPOfqGd9s3MA+v8+sAPaGs//6GqjkQC5Ag0EVhbZ XQEQALYkngci9UgDa17n0ZvdBrXlFBwETpL8k7YbeCH2a3fzyTAALCzIPOqx1pEB c5FxTsw8LhG1I7xSiQn/M+litM+Q6G/diEuGQeECUSwkjECkUMg0rjtQa9m+3N6x FCmk+JL+VPyB/9p/g0sS2iacbNi+ckFAK/jATRP1DzxXHalpw3PzsBe1mkjjiFeK Xbcsv9wtCmS4PfqZFOvhjo9ArcCzYUBW77f9iBOJ5LjUVRuwyywT8y3vbRA3eH4q /SCvz+nSZgY4+1Raw2vUUvWAfcpDEUmKIIP6ymagivM1jFGTeFu58xm0UB0ajsIR TKBI8nBeDMzW/HlMKEtQi3iExuuUUkq/8FnG/oVS/yJukouO+2CKjkQLdZlSM3/j TpgR6Ca1KZMmYuWa2Z9/7dMhM6u3/BAytrFOTCiKsHwwVQ2guuIivZx3EJ0bXQZY bnzeFsW2DXupvVcgEc3fhVdnuxVj0ia01dpkGjFq1/iCfq/Y+DNw9aAsEmSDkGGT qUeOYLYeeElzXRM2zryI6EKy6E9JQWp3mRLBOE2bywJwlJQN+5pMLSb3PSE5WWee ynhW/IJmYSmZmq3AMbnZcE2DYmAZdk91Ob0vu5vvZ4MBGmXD9ypFaiR47lgFzBhA 1/Ej8X3+77/OvCAk0pCBF0HOLHEZRpTcKFzD9ZH78ShZ2EpjABEBAAGJAh8EGAEC AAkFAlYW2V0CGwwACgkQVmjwA0F6imhnGQ//d99nxo20lY0vG4ALlefVS9g2Q88p qyUqMtZj3Q9gQoWWeh/37xIzpKcO3DsJFtSiuv13F0N7RbbEpcPkclILLX0Ai1+v h9L4sV+39ipiLf6JNnNkswkAw8wuED5zXoDF6k6e5LDdZRNSKjv3hXbDOzN35M7p fbJMxrzm4tksQGkibTtrrzSVLPWp+ATRcYTeO5m7wAikf/1/vRcc/vAT4mKaitIr CgTfbgoVff9zL61dWiH5EUyJRkRqAj5FX8rrQ+Yb8ZeDfXw/tt+FgpzfM6w38xuc +oL0hgCBE9IXvuwcRbu+W4m130mJhdcJCu7/ibuqFFazE+LDXhSpS5Sjg2bo1W8l RwpfG38q0DXBXwde6AEBWeIGhUVWO+iZahCeU5b1lmmFC3lJ+/yT12lK8JTDuG2o usyz9tQxmLvx6NJrYnIU6AR7Kmjtbot+oUDODRmgUfKajgEy4wPEANmwfGEgQjAw TpDG+rfBn3dZ5efRU20t61Q5/Xr5fiDdGnqVei/2Gq5qSGbx/20hzcoOS82E/jyL g7SYKX6cdwqdeguzGdJYlp2TCwCgGZC2msEBCcwwSjuUs9Qt3bUnFhlSp0knoTmZ amkT8Q/pMfdj+0M2+4ER9kDbwRNfSHJSeg2+Sk8buCdmucKBY1WeXdEiY+EqrRBD 7u5Pm9GH/BR7FIQ= =KgoN - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Processed by Mailcrypt 3.5.9 <http://mailcrypt.sourceforge.net/> iQIcBAEBAgAGBQJWP87hAAoJEFZo8ANBeopo9dAQAKlCJepH4yr/OYKI1Gz2iX0o gSBZeAp7itUBCTWgU2f34kXGkLkv+LtWGJml/U1ud3H33XqZBnWwOAwE6/Z4Z22u 8Hk/+q0jmuPJHQv8Rz1w9kP7O9p6pwWm+X5j3Gvj5Vd7F6w8lMINojpwFiapWdP/ nnuTWylr/BOmgIu3toloyVrPzGWU/2ApiNECVskU0h/SfyhDJP6tHkhtpyH/l3YH wJEMGO9DUZkE6WovmWqxk20PbHGXLKjYjGy/bDh5nqYfByoVk/7TfnUmUmRVBce7 bKYBaJLpDHNU99HL71xv6snAOmytNbL7a1c/TVvl0lgsBiThqIOLZyaTS0VER2+W Gse8hd8hBp6q/9VCeee49QGC0T6CXUxAOv1g9IUT4F+s1DXds1wuNReCJdXhLtag 1d2nZRc3fhqc/jXbUCwLYp3k0WvDYS0OCVqxXLxE1OKpuZPMlaOzrPdy5qE8tsCb qWm6Si3fnx6om3Q/BA0QFcnvw8MB/rwF7/Vs2YYY+iiJquNc6IxEfeNqjv/fwgCc XTrUHW1R29PN6k7eHDpFw8BkDX6OoD83hGUVpgSYyjR6vFGN95J98pDnzJZ0EvsL GNzO/b9CmwD1mcSjFYp26/3pDNXDftMpVwf9IPnKwdr3xhoYzhw0g7ZeUiVYGYvp eHSdvPIZuJJGqHHcxfxo =gzUD -----END PGP SIGNATURE----- _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography

3 2

Re: Suggest High-Signal Crew Ditch This for Reddit
by dan＠geer.org 09 Nov '15

09 Nov '15

http://news.yahoo.com/nastiness-threatens-online-reader-comments-053929979.… the gist: we need algorithms to prevent free speech we don't like and until we have them we're turning off/down comments freedom, safety, comfort -- choose two... --dan

4 3

Re: FOIPA adventures
by Ryan Carboni 09 Nov '15

09 Nov '15

http://www.dni.gov/files/documents/FOIA/DF-2015-00270.pdf You're famous!

2 1

‘I’m comfortable with my choices’: Snowden on CIA torture, ISIS and surveillance
by Zenaan Harkness 09 Nov '15

09 Nov '15

https://www.rt.com/news/321105-snowden-swedish-media-interview/ http://fokus.dn.se/edward-snowden-english/

3 3