- cypherpunks - lists.cpunks.org

Privacy Centric Naming of Humans
by grarpamp 26 Mar '16

26 Mar '16

https://developers.slashdot.org/story/16/03/26/2017231/names-that-break-com… https://cpunks.org/pipermail/cypherpunks/2015-May/007632.html Breaking the db as a means of remaining out of the db, or hiding in it among hundred thousands of Smiths. Be own corp / trust.

1 0

Bitcoin GoldBugs / Ghetto Gold
by grarpamp 26 Mar '16

26 Mar '16

On 3/26/16, elrippo <elrippo(a)elrippoisland.net> wrote: > *Want to trade Bitcoin for physical GOLD* -> > https://www.vaultoro.com/?a=100345 Their logical gold, needs minor KYC. And to get their physical, needs anal probing KYC. Bitcoiners who care about that are better off going btc > localcash > gold. Or skip btc and go cash > gold at any ghetto shop. Nice try at referral link tho bruh.

1 0

Re: [tor-talk] Traffic shaping attack
by grarpamp 26 Mar '16

26 Mar '16

On 3/20/16, Mike Perry <mikeperry(a)torproject.org> wrote: > For example, I wonder if users see such interrupts on all of their Tor > traffic at that time, or just hidden service traffic? Or just hidden > service traffic to specific services? ... the OP appears to know the onion url and refers to fora discussion the situation. So OP should post those links for others to review analyse formulate hypothesis etc. Not as if OP and all have not already been shaped / confirmed themselves or that links [to links] mean anything. Oh noes, thousands links in your mbox... http://skunksworkedp2cg.onion/

2 1

Oracle slurs PostgreSQL - was Re: Russia bans purchase of foreign non-niche software in Russian state agencies
by Zenaan Harkness 26 Mar '16

26 Mar '16

Dear Russian computing punk friends - enjoy, and holler for any questions you might have - now is the time to sieze the day. pgsql-general email thread link is below - best for specific database tech questions. We figured some backlash might come to Putin's pro-local (i.e. effectively also "libre") software policy ("nasty protectionists" say the globalisation nuts), and Oracle the corporate $LUT$ they are, recently leaped right in Lucifer Style (Gangnam eat your heart out). This attack on local in particular smaller Russian businesses, by Oracle against PostgreSQL is some evidence that Putin's policy is having an effect in Russia which Oracle is disliking (does your heart bleed for Oracle's loss of profits in Russia? Those poor, poor American billionaires...). Now is a fantastic opportunity for those individual and business entrepreneurs in Russia to use your words and advocacy to fight this particular American bully. Enjoy :) This is free publicity you just can't beat, couldn't purchase. Find good word smiths in Russia, play the various cards - "Oracle attacks the little guy", "Oracle attacks community", "Oracle tries to maniuplate Russia" "no Oracle, we're not that stupid, basic facts are not, like, rocket science or anything" and every other combination that makes sense in Russia. Pump it to your media, bounce your links to the PostgreSQL mailing list linked below, build that nationalist/ community/ local guys spirit. A multi billion dollar American bully trying to shirt-front Russia! Gold! Just gold! Marketing material you could never buy! Little guys vs Billion dollar bullies. Fantastic! Once this publicity is milked, letters should be sent to Larry Ellison and the rest of the Oracle board, thanking them sincerely for their efforts to promote Russian local business and Russian computing self confidence - as well as for raising awareness of the aggressive and bullying nature of American money, Starikov style :) : http://russia-insider.com/en/politics/russian-patriotic-party-thanks-obama-… "Russian Political Party Trolls Obama and Kerry by Sending Thank-You Cards" Perhaps Oracle should try to sell their wares in the CIA's project Ukraine?: http://russia-insider.com/en/politics/ukrainian-refugees-flood-eu-poland-co… "Poland Considers Building a Wall - Against Ukrainians" (Just as well the western Ukrainians are wealthy folk, honourable with their many multi-billion dollar IMF loans, and about to join the EU eh? Oracle should fit right in, feel right at home...) http://momjian.us/main/blogs/pgblog/2016.html#March_22_2016 Oracle Attacks Postgres in Russia Bruce Momjian "Tuesday, March 22, 2016 During my twenty years with Postgres, I knew the day would come when proprietary databases could no longer ignore Postgres and would start attacking us. Well, that day has come, at least in Russia. During the past few weeks, Oracle sent a letter (Russian http://www.postgresql.org/message-id/attachment/43080/PostgreSQL_Oracle.pdf , English translation https://www.metachris.com/download/PostgreSQL_Oracle_en.pdf ) to Russian partners and customers comparing Oracle favorably to Postgres as a way of cirumventing a new law ( http://www.themoscowtimes.com/business/article/russia-restricts-use-of-fore… ) favoring Russian-produced software. This is the first direct attack I have seen on Postgres, and is probably representative of the kinds of attacks we will see from other vendors and in other countries in the years to come. The press has picked up on the news (Russian http://momjian.us/main/blogs/pgblog/www.vedomosti.ru/technology/articles/20… , English http://www.theregister.co.uk/2016/03/21/oracle_fights_russian_software_poli… ) and given balanced coverage. Comments ( http://forums.theregister.co.uk/forum/1/2016/03/21/oracle_fights_russian_so… ) on the English article were, in general, positive — I particularly liked this one ( http://forums.theregister.co.uk/forum/1/2016/03/21/oracle_fights_russian_so… ). There are two Hacker News threads about it (1 https://news.ycombinator.com/item?id=11317899 , 2 https://news.ycombinator.com/item?id=11332449 ), a community thread ( http://www.postgresql.org/message-id/flat/CANNMO++6tPiwBv2OKcy-HhiYmByhL+XS… ) about it, and another community thread about Oracle RAC ( http://www.postgresql.org/message-id/flat/ncotsa$lhg$1@pye-srv-01.telemetry… ). Taken together, this is an interesting time for Postgres. " http://www.msearcher.info/blog-en/software/oracle-fights-russian-software-p… Oracle fights Russian software policy with Postgres smear An email calling for links to pro-PostgreSQL advocacy http://www.postgresql.org/message-id/ncotsa$lhg$1@pye-srv-01.telemetry.co.uk The whole thread: http://www.postgresql.org/message-id/flat/ncotsa$lhg$1@pye-srv-01.telemetry… Begins: "If anybody puts together a "just the facts" document after Oracle's attack on PostgreSQL in Russia, please make sure it's drawn to the attention of this mailing list for the benefit of those who aren't in -advocacy."

1 0

Is Gutmann critical of DJB in "On the Impending Crypto Monoculture"
by Georgi Guninski 26 Mar '16

26 Mar '16

http://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html On the Impending Crypto Monoculture Peter Gutmann Is Gutmann critical of DJB (the creator of the divine qmail)? (there is some disagreement about this with alleged linux admins). Maybe I will troll DJB no matter which way it is ;)

3 4

Can we legally borrow some sploits from TLAs?
by Georgi Guninski 26 Mar '16

26 Mar '16

Public list for this is not a good idea. Can we legally borrow some sploits from TLAs? Maybe sufficiently sophisticated honeypot? (I am not good at this). Anything already implemented?

2 2

Cloudflare blogs on their Cert Tech
by Rayzer 25 Mar '16

25 Mar '16

Wondering if their cert tech can spoof a cert to look like it belongs to a site they DNS when it really belongs to them and you've never really visited the site at all. TLS Certificate Optimization: The Technical Details behind "No Browser Left Behind" Overview Back in early December we announced our "no browser left behind" initiative to the world. Since then, we have served well over 500 billion SHA-1 certificates to visitors that otherwise would not have been able to communicate securely with our customers’ sites using HTTPS. All the while, we’ve continued to present newer SHA-2 certificates to modern browsers using the latest in elliptic curve cryptography, demonstrating that one does not have to sacrifice security to accommodate all the world’s Internet users. (If you weren’t able to acquire a SHA-1 certificate before CAs ceased issuing them on 2015/12/31, you can still sign up for a paid plan and we will immediately generate one to serve to your legacy visitors.) Shortly after we announced these new benefits for our paid Universal SSL customers, we started hearing from other technology leaders who were implementing (or already had implemented) similar functionality. At first glance, the logic to identify incoming connections that only support SHA-1 seems straightforward, but as we spoke with our friends at Facebook, Twitter, and Mozilla, I realized that everyone was taking a slightly different approach. Complicating the matter even further was the fact that at CloudFlare we not only wanted to optimize between SHA-1 and SHA-2, but also between RSA and the newer, but less universally supported ECDSA certificates. Solve the "optimal certificate" question incorrectly, and the TLS handshake will fail — or get explicitly aborted by browsers that have deprecated SHA-1 entirely; solve it correctly, and the client and server will establish the most performant, secure connection available between the two endpoints. Certificate Optimization Logic After several trillion requests, we’re confident that our approach works quite well for CloudFlare’s customers and their visitors. If you have taken an alternative approach to implementation, or have found any exceptions/potential refinements to our logic, please chime in below. We remain committed to withdrawing SHA-1 support if, as our CEO said, "a vulnerability is discovered [in our certificate optimization logic] which allows some form of downgrade attack—where a modern browser can be tricked into receiving a certificate signed with an insecure protocol—and the vulnerability cannot be patched". TLS Handshake Before your web browser can securely exchange "application data" such as HTTP GET or POST requests and responses with a web server, it must first establish the cryptographic parameters of the secure session. This well-choreographed dance, known as the SSL/TLS handshake, commences as soon as you click, type, or get redirected to a URL containing the "https://" scheme. (The process described below also applies to connections from any user agent — not just browsers—so substitute "mobile app", "command-line utility", or anything else that can communicate via HTTPS.) More: https://blog.cloudflare.com/tls-certificate-optimization-technical-details/ -- RR "Through counter-intelligence it should be possible to pinpoint potential trouble-makers ... And neutralize them, neutralize them, neutralize them"

2 2

Fwd: [secu-share] Whatsapp, a Trojan horse for seekers of easy privacy?
by grarpamp 25 Mar '16

25 Mar '16

---------- Forwarded message ---------- From: carlo von lynX <lynX(a)time.to.get.psyced.org> Date: Thu, 15 Jan 2015 14:26:50 +0100 Subject: [secu-share] Whatsapp, a Trojan horse for seekers of easy privacy? To: liberationtech(a)mailman.stanford.edu Concerning Whatsapp there is a very interesting clue in a thread on "messaging" that suggests users will never know if end-to-end encryption is being used, since the server decides whether they are allowed to, and the user is not informed. Knowing the NSA that means that Whatsapp would never encrypt anything end-to-end. Whatsapp should therefore be considered a Trojan horse for people seeking easy to use privacy. Read about that at https://moderncrypto.org/mail-archive/messaging/2014/001133.html Careful on using that mailing list however. If I understood correctly it is being maintained by one of the developers of TextSecure, which is the end-to-end encryption system that has been integrated into Whatsapp, possibly with the purpose of looking good, making good headlines and never being actually run. http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ Of course I assume everyone is operating in the best of intentions, including the NSA. This is just FYI. -- http://youbroketheinternet.org ircs://psyced.org/youbroketheinternet -- secu-share(a)lists.secushare.org https://lists.secushare.org/mailman/listinfo.cgi/secu-share

1 0

On money - "Why we need to beat Russia"
by Zenaan Harkness 25 Mar '16

25 Mar '16

http://thesaker.is/why-we-need-to-beat-russia/ Quotes: "Our Imperial weapons give definite form to our Empire. And nothing has shaped our Empire more than the FIAT. The deformation began in 1971, when the US imposed her Power to re-define the rules of the monetary system for her sole benefit. The ability to print IOU’s in exchange for real value is more clever than theft as we borrow and do not pay back in kind due to inflation. Our enemies, adversaries and vassals must found their financial systems upon the printed dollar which they must purchase with hard earned money. That seizure has financed a vast network of military bases, bribery, assassinations, coup d´états and perpetual war. What’s not to like? All that Power without taxing the produce of the American people. So why have we lost in Syria?" "But whom, may we ask, has the power to decree wealth? And with such great power to do so, who can be trusted with such great responsibility? No one. That is who." "Inequality of Wealth, therefore, always reaches its peak at the end of the FIAT timeline." "That is the death blow. The Fiat produced a parasite – the financial sector – that in its greed is killing the real economy." "Monsanto can darken the sunflower harvest in the Ukraine, and Allianz can steal a few tranquil Greek islands, but the ambience is never quite the same as when hard working people had their just rewards, and goodness and charity and kind souls rejoiced – with compassion and cooperation – while loving the narrative of a life written while desiring only the product of their work. The world this Global Reserve Fiat creates is one of misery and strife where evil and greed feeds upon the spirit, and the world becomes an immoral wasteland of modernity [I would add: "and war"]. The worker is discriminated against as all pressure and stress is heaped upon his future, as the law discriminates between debts held as an asset vs. debt held as a liability." "Now, the East – China / Russia / India – challenge the Global Reserve Fiat. And when the dollar fails, and it will: For debt is the essence of fiat, and when it defaults, the system defaults with it." "And when the 98% – their future burdened by intolerable debt, unemployment and declining wages – decide to walk away? The fear of that decision has been driving interest rates down for decades, to make it bearable not for the good of mankind but to prolong the system. This brings into relief an internal contradiction: wages decline in sync with interest rates because the bargaining power of workers evaporates as Central Bankers reduce the cost of capital, contributing to the substitution of labour and labour wages by that of the machines and AI software [should just have said "by mechanisation and automation", but hey, who's quibbling...]." "As we look at the precarious nature of our faith-based money, we must acknowledge the moral implications of “dishonest money”. Seizure by decree, whether judged just by Constituted Power, is immoral. But the fact that dishonest money is so easy to create, control and redistribute helps one understand the wave of immorality that has swept over our world." ["faith based money" - great phrase!] "Our Imperial weapon will die by both edges of its own sword, one being the contempt with which it is so easily created to bend the will of the world to its bidding, and the other sharp edge which the wicked are blind to recognize: The evil that sound money prohibits." "The Dynasties of Wealth - Have you ever wondered how we hedge our holdings through turmoil? The top 85 patricians of which own more wealth than the bottom 3.5 billion humans – will move first. The 1%, then 2% and whoever else left standing will be forced to follow through." "They easily control men through greed and are beholden to Gold alone. Gold transitions their wealth recycling system through change."

1 0

Re: [Cryptography] Hayden on encryption v. metadata
by grarpamp 25 Mar '16

25 Mar '16

On 3/24/16, J.M. Porup <jm(a)porup.com> wrote: > On Wed, Mar 23, 2016 at 05:11:11PM -0700, Henry Baker wrote: >> https://www.lawfareblog.com/lawfare-podcast-general-michael-hayden-discusse… >> >> Highly recommended, *especially* if you disagree with Hayden. >> >> Basically, Hayden is ok with just about anything -- including torture -- >> so long as it is approved by someone higher up. Methinks he might not >> fare so well in a Nuremburg-type trial, but perhaps those ethics are sooo >> last century. > > Maybe it's time to start publicly calling for Nuremberg-style war crimes > tribunals to arrest, prosecute, convict, imprison, and execute senior > surveillance state officials? Who exactly is going to post these prosecutors... congress, courts, doj, Obama? They already excused / ignored / approved of Bush, Cheney, cabinets et al, telecoms, NSA, too big to fail, QE[n], deficits and debt, overclassification, droning, ubiquitous surveillance, murder, papers please, pollution, Abu Gitmo, torture, revolving door, CIA, tech backdoors, rendition and infinite detention, databases, etc.......... What are you gonna do, round up a posse, pin on some badges, saddle up and ride on over to DC? Where and when exactly does the buck stop? Putin / Ecuador? Collapse? Seriously. You might want to figure that out...

1 0