- cypherpunks - lists.cpunks.org

Re: [Cryptography] More Bad Govt Shit To Fight (Burner Verizon FBI)
by grarpamp 27 Mar '16

27 Mar '16

On 3/26/16, Ray Dillinger <bear(a)sonic.net> wrote: > > > On 03/26/2016 07:24 AM, Henry Baker wrote: >> It'll be interesting to see how this bill is received. >> >> IMHO the vast majority of these phones -- at least here in California -- >> are used by undocumented residents, who have no papers, no driver's >> licenses, no bank accounts, and operate 100% on cash. >> > > I'm also in California but the main use I see is at halfway > houses and womens' shelters. There are a lot of scared battered > women out there who can't disentangle exes from their financial > crap fast enough to establish independent phone service without > them, and a lot of shelters that go through them like tissues. > > It's a pretty big deal for them because there are *LOTS* of violent > loons who are trying to find those places, and everyone who winds > up there is completely inexperienced in the art of Not Being Seen. > Lots of chances for one person's mistake to become everybody's > problem, and phones are like the "ablative surface" that can be > gotten rid of for mutual protection when someone makes a mistake. > > I see their IT manager at Urban Ore, buying a basket full of > old used phones, almost every time I'm over there. You would be surprised how many *men* have to deal with crazy battering women and need to seek refuge in shelters and safe supportive halfway houses for men. Either way, all such people who are innocent enjoy the right for the government and commerce not to impede upon their right to privacy, including shielding their innocent selves from warrantless govt and commercial tracking and datakeeping. Stop giving away your rights and taking those of other innocents. For it is not the criminal they are after, but control over you.

2 1

GitHub's 2014 Transparency Report (and dmca repo)
by Georgi Guninski 27 Mar '16

27 Mar '16

GitHub's 2014 Transparency Report https://github.com/blog/1987-github-s-2014-transparency-report dmca repo: https://github.com/github/dmca

1 0

Privacy Centric Naming of Humans
by grarpamp 26 Mar '16

26 Mar '16

https://developers.slashdot.org/story/16/03/26/2017231/names-that-break-com… https://cpunks.org/pipermail/cypherpunks/2015-May/007632.html Breaking the db as a means of remaining out of the db, or hiding in it among hundred thousands of Smiths. Be own corp / trust.

1 0

Bitcoin GoldBugs / Ghetto Gold
by grarpamp 26 Mar '16

26 Mar '16

On 3/26/16, elrippo <elrippo(a)elrippoisland.net> wrote: > *Want to trade Bitcoin for physical GOLD* -> > https://www.vaultoro.com/?a=100345 Their logical gold, needs minor KYC. And to get their physical, needs anal probing KYC. Bitcoiners who care about that are better off going btc > localcash > gold. Or skip btc and go cash > gold at any ghetto shop. Nice try at referral link tho bruh.

1 0

Re: [tor-talk] Traffic shaping attack
by grarpamp 26 Mar '16

26 Mar '16

On 3/20/16, Mike Perry <mikeperry(a)torproject.org> wrote: > For example, I wonder if users see such interrupts on all of their Tor > traffic at that time, or just hidden service traffic? Or just hidden > service traffic to specific services? ... the OP appears to know the onion url and refers to fora discussion the situation. So OP should post those links for others to review analyse formulate hypothesis etc. Not as if OP and all have not already been shaped / confirmed themselves or that links [to links] mean anything. Oh noes, thousands links in your mbox... http://skunksworkedp2cg.onion/

2 1

Oracle slurs PostgreSQL - was Re: Russia bans purchase of foreign non-niche software in Russian state agencies
by Zenaan Harkness 26 Mar '16

26 Mar '16

Dear Russian computing punk friends - enjoy, and holler for any questions you might have - now is the time to sieze the day. pgsql-general email thread link is below - best for specific database tech questions. We figured some backlash might come to Putin's pro-local (i.e. effectively also "libre") software policy ("nasty protectionists" say the globalisation nuts), and Oracle the corporate $LUT$ they are, recently leaped right in Lucifer Style (Gangnam eat your heart out). This attack on local in particular smaller Russian businesses, by Oracle against PostgreSQL is some evidence that Putin's policy is having an effect in Russia which Oracle is disliking (does your heart bleed for Oracle's loss of profits in Russia? Those poor, poor American billionaires...). Now is a fantastic opportunity for those individual and business entrepreneurs in Russia to use your words and advocacy to fight this particular American bully. Enjoy :) This is free publicity you just can't beat, couldn't purchase. Find good word smiths in Russia, play the various cards - "Oracle attacks the little guy", "Oracle attacks community", "Oracle tries to maniuplate Russia" "no Oracle, we're not that stupid, basic facts are not, like, rocket science or anything" and every other combination that makes sense in Russia. Pump it to your media, bounce your links to the PostgreSQL mailing list linked below, build that nationalist/ community/ local guys spirit. A multi billion dollar American bully trying to shirt-front Russia! Gold! Just gold! Marketing material you could never buy! Little guys vs Billion dollar bullies. Fantastic! Once this publicity is milked, letters should be sent to Larry Ellison and the rest of the Oracle board, thanking them sincerely for their efforts to promote Russian local business and Russian computing self confidence - as well as for raising awareness of the aggressive and bullying nature of American money, Starikov style :) : http://russia-insider.com/en/politics/russian-patriotic-party-thanks-obama-… "Russian Political Party Trolls Obama and Kerry by Sending Thank-You Cards" Perhaps Oracle should try to sell their wares in the CIA's project Ukraine?: http://russia-insider.com/en/politics/ukrainian-refugees-flood-eu-poland-co… "Poland Considers Building a Wall - Against Ukrainians" (Just as well the western Ukrainians are wealthy folk, honourable with their many multi-billion dollar IMF loans, and about to join the EU eh? Oracle should fit right in, feel right at home...) http://momjian.us/main/blogs/pgblog/2016.html#March_22_2016 Oracle Attacks Postgres in Russia Bruce Momjian "Tuesday, March 22, 2016 During my twenty years with Postgres, I knew the day would come when proprietary databases could no longer ignore Postgres and would start attacking us. Well, that day has come, at least in Russia. During the past few weeks, Oracle sent a letter (Russian http://www.postgresql.org/message-id/attachment/43080/PostgreSQL_Oracle.pdf , English translation https://www.metachris.com/download/PostgreSQL_Oracle_en.pdf ) to Russian partners and customers comparing Oracle favorably to Postgres as a way of cirumventing a new law ( http://www.themoscowtimes.com/business/article/russia-restricts-use-of-fore… ) favoring Russian-produced software. This is the first direct attack I have seen on Postgres, and is probably representative of the kinds of attacks we will see from other vendors and in other countries in the years to come. The press has picked up on the news (Russian http://momjian.us/main/blogs/pgblog/www.vedomosti.ru/technology/articles/20… , English http://www.theregister.co.uk/2016/03/21/oracle_fights_russian_software_poli… ) and given balanced coverage. Comments ( http://forums.theregister.co.uk/forum/1/2016/03/21/oracle_fights_russian_so… ) on the English article were, in general, positive — I particularly liked this one ( http://forums.theregister.co.uk/forum/1/2016/03/21/oracle_fights_russian_so… ). There are two Hacker News threads about it (1 https://news.ycombinator.com/item?id=11317899 , 2 https://news.ycombinator.com/item?id=11332449 ), a community thread ( http://www.postgresql.org/message-id/flat/CANNMO++6tPiwBv2OKcy-HhiYmByhL+XS… ) about it, and another community thread about Oracle RAC ( http://www.postgresql.org/message-id/flat/ncotsa$lhg$1@pye-srv-01.telemetry… ). Taken together, this is an interesting time for Postgres. " http://www.msearcher.info/blog-en/software/oracle-fights-russian-software-p… Oracle fights Russian software policy with Postgres smear An email calling for links to pro-PostgreSQL advocacy http://www.postgresql.org/message-id/ncotsa$lhg$1@pye-srv-01.telemetry.co.uk The whole thread: http://www.postgresql.org/message-id/flat/ncotsa$lhg$1@pye-srv-01.telemetry… Begins: "If anybody puts together a "just the facts" document after Oracle's attack on PostgreSQL in Russia, please make sure it's drawn to the attention of this mailing list for the benefit of those who aren't in -advocacy."

1 0

Is Gutmann critical of DJB in "On the Impending Crypto Monoculture"
by Georgi Guninski 26 Mar '16

26 Mar '16

http://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html On the Impending Crypto Monoculture Peter Gutmann Is Gutmann critical of DJB (the creator of the divine qmail)? (there is some disagreement about this with alleged linux admins). Maybe I will troll DJB no matter which way it is ;)

3 4

Can we legally borrow some sploits from TLAs?
by Georgi Guninski 26 Mar '16

26 Mar '16

Public list for this is not a good idea. Can we legally borrow some sploits from TLAs? Maybe sufficiently sophisticated honeypot? (I am not good at this). Anything already implemented?

2 2

Cloudflare blogs on their Cert Tech
by Rayzer 25 Mar '16

25 Mar '16

Wondering if their cert tech can spoof a cert to look like it belongs to a site they DNS when it really belongs to them and you've never really visited the site at all. TLS Certificate Optimization: The Technical Details behind "No Browser Left Behind" Overview Back in early December we announced our "no browser left behind" initiative to the world. Since then, we have served well over 500 billion SHA-1 certificates to visitors that otherwise would not have been able to communicate securely with our customers’ sites using HTTPS. All the while, we’ve continued to present newer SHA-2 certificates to modern browsers using the latest in elliptic curve cryptography, demonstrating that one does not have to sacrifice security to accommodate all the world’s Internet users. (If you weren’t able to acquire a SHA-1 certificate before CAs ceased issuing them on 2015/12/31, you can still sign up for a paid plan and we will immediately generate one to serve to your legacy visitors.) Shortly after we announced these new benefits for our paid Universal SSL customers, we started hearing from other technology leaders who were implementing (or already had implemented) similar functionality. At first glance, the logic to identify incoming connections that only support SHA-1 seems straightforward, but as we spoke with our friends at Facebook, Twitter, and Mozilla, I realized that everyone was taking a slightly different approach. Complicating the matter even further was the fact that at CloudFlare we not only wanted to optimize between SHA-1 and SHA-2, but also between RSA and the newer, but less universally supported ECDSA certificates. Solve the "optimal certificate" question incorrectly, and the TLS handshake will fail — or get explicitly aborted by browsers that have deprecated SHA-1 entirely; solve it correctly, and the client and server will establish the most performant, secure connection available between the two endpoints. Certificate Optimization Logic After several trillion requests, we’re confident that our approach works quite well for CloudFlare’s customers and their visitors. If you have taken an alternative approach to implementation, or have found any exceptions/potential refinements to our logic, please chime in below. We remain committed to withdrawing SHA-1 support if, as our CEO said, "a vulnerability is discovered [in our certificate optimization logic] which allows some form of downgrade attack—where a modern browser can be tricked into receiving a certificate signed with an insecure protocol—and the vulnerability cannot be patched". TLS Handshake Before your web browser can securely exchange "application data" such as HTTP GET or POST requests and responses with a web server, it must first establish the cryptographic parameters of the secure session. This well-choreographed dance, known as the SSL/TLS handshake, commences as soon as you click, type, or get redirected to a URL containing the "https://" scheme. (The process described below also applies to connections from any user agent — not just browsers—so substitute "mobile app", "command-line utility", or anything else that can communicate via HTTPS.) More: https://blog.cloudflare.com/tls-certificate-optimization-technical-details/ -- RR "Through counter-intelligence it should be possible to pinpoint potential trouble-makers ... And neutralize them, neutralize them, neutralize them"

2 2

Fwd: [secu-share] Whatsapp, a Trojan horse for seekers of easy privacy?
by grarpamp 25 Mar '16

25 Mar '16

---------- Forwarded message ---------- From: carlo von lynX <lynX(a)time.to.get.psyced.org> Date: Thu, 15 Jan 2015 14:26:50 +0100 Subject: [secu-share] Whatsapp, a Trojan horse for seekers of easy privacy? To: liberationtech(a)mailman.stanford.edu Concerning Whatsapp there is a very interesting clue in a thread on "messaging" that suggests users will never know if end-to-end encryption is being used, since the server decides whether they are allowed to, and the user is not informed. Knowing the NSA that means that Whatsapp would never encrypt anything end-to-end. Whatsapp should therefore be considered a Trojan horse for people seeking easy to use privacy. Read about that at https://moderncrypto.org/mail-archive/messaging/2014/001133.html Careful on using that mailing list however. If I understood correctly it is being maintained by one of the developers of TextSecure, which is the end-to-end encryption system that has been integrated into Whatsapp, possibly with the purpose of looking good, making good headlines and never being actually run. http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ Of course I assume everyone is operating in the best of intentions, including the NSA. This is just FYI. -- http://youbroketheinternet.org ircs://psyced.org/youbroketheinternet -- secu-share(a)lists.secushare.org https://lists.secushare.org/mailman/listinfo.cgi/secu-share

1 0