- cypherpunks - lists.cpunks.org

US Gov TSA to the People: Papers Please
by grarpamp 29 Dec '15

29 Dec '15

http://yro.slashdot.org/story/15/12/28/2132237/tsa-moves-closer-to-rejectin… Jad Mouawad writes at the NYT that a driver's license may no longer be enough for airline passengers to clear security in some states... https://en.wikipedia.org/wiki/REAL_ID_Act http://papersplease.org/

2 1

Re: [Cryptography] Understanding state can be important.
by grarpamp 29 Dec '15

29 Dec '15

On Mon, Dec 28, 2015 at 2:45 PM, Ray Dillinger <bear(a)sonic.net> wrote: [look it up on metzdowd] > There is no physical basis for security we're truly certain of > to even be built any more. > > And we allowed it to happen. Cry baby cry. Yet whenever anyone suggests actually exploring parameters (you know, doing work) of potential solutions such as open fabs... it's all omg, cost, and we're stupid it's impossible, followed by crickets. Baby is as baby does.

2 1

TheCthulhu / CthulhuSec to Cryptome
by Michael Best 29 Dec '15

29 Dec '15

I'm curious what everyone thinks. I personally agree with TheCthulhu, but I'm not a tech or crypto expert. Original: https://www.thecthulhu.com/a-response-to-cryptome/ So today (20th December) I posted a mirror of the Cryptome archive I received from a close associate of mine (of whom I trust greatly) and was met by a rather blunt response from the Cryptome administrators regarding the integrity of the data I host. As many know, I take the subject of tampering very seriously, and whenever I have leaked or shared data I strive to provide it with a SHA1 and SHA256 hash at a minimum and also provide torrents, HTTPS and onion download options. Furthermore, if ever asked, I would also sign files using my personal PGP key. [image: 7fc92ced0b91c71560dcdc251bc2a0d9] <https://www.thecthulhu.com/wp-content/uploads/7fc92ced0b91c71560dcdc251bc2a…> The response I received from Cryptome was also either hinting that the entire research and crypto community is wrong in their conclusions, or that the Cryptome administrators don’t understand it themselves. The assumption that cryptography is unbreakable assuming an adversary with unlimited resources is wrong, even an adversary with limited resources given enough time can break all cryptography, but that doesn’t make it anything other than a theoretical matter when put into the actual context. This statement in particular “Mirroring is tampering. We ask that mirrors be labeled as tampering.” really also irritates me. If Cryptome is so concerned that data is being tampered with, I suggest the following: 1. An MD5, SHA1, SHA256, SHA512 and Whirlpool digest be produced for the full archive of files in a format such as .zip or .tar. 2. The Cryptome administrators sign all the digests in a single PGP message to verify the hashes match the archive they produced. 3. The PGP signed message is published with the digests for 14 days on the Cryptome website, Twitter, my Twitter, my blog and any other source who wishes to make a copy of it. The 14 day period allows time for any party to raise concerns if say for example, a third party had stolen the PGP keys to forge the signature then the Cryptome administrators should have had time to realise this and either revoke the key or in some way suggest the archive is not legitimate. 4. After the 14 day period, the archive is made available publicly to which I shall ensure the hashes can be reproduced on my end, and then I will also sign the digests message to say it is the one I received and will be mirroring. 5. A torrent file can be produced which downloads the archive file specified above; this can also be signed by myself and Cryptome so people can be sure it is the one we intended to distribute and another layer of checks by checking the hash once downloaded exists. 6. External parties such as Twitter followings, security researchers etc cross sign the digests and our keys if they know us sufficiently and trust the archive is true as it was intended to be distributed. If the above procedure is not sufficiently secure, then one must operate on the assumption all technology is unsafe to use. There is the legitimate concern of hardware tampering and backdoors, which is why open source software should be used at all stages. However, I would like to draw attention to the fact that Cryptome offers the full archive for $100 which is shipped via USB. Therefore, concerns regarding hash or cryptographic security yet readily shipping USBs seems to me a fairly extreme state of cognitive dissonance given what is known about attacks like BadUSB and state physical interception operations. I call on Cryptome to start allowing proper mirroring of content. Nobody has called upon Cryptome to host the content themselves or in any way incur additional costs. What is being asked is that you provide the content with reasonable security as I propose above, rather than completely ignoring the matter which will drastically reduce the security and safety of downloads. If you claim to be all about anti-censorship and transparency, then the measures I propose above are a good fit. This isn’t about offering 100% perfect security, this is about offering people the ability to verify the files in a manner which is reasonable and proportionate to the technology even state level adversaries currently possess. Even if you disagree on the security of the cryptographic protocols and measures I describe above, know that the vast majority of researchers and information security professionals disagree with you, and that providing it is still far better than not providing the hashes at all.

6 6

Seeking Anonymity in an Internet Panopticon - collective anonymity vs. individualized anonymity
by coderman 29 Dec '15

29 Dec '15

https://cryptome.org/2015/12/anon-v-panopticon.pdf ''' We believe the vulnerabilities and measurability limitations of onion routing may stem from an attempt to achieve an impossible set of goals and to defend an ultimately indefensible position. Current tools offer a general-purpose, unconstrained, and individualistic form of anonymous Internet access. However, there are many ways for unconstrained, individualistic uses of the Internet to be fingerprinted and tied to individual users. We suspect that the only way to achieve measurable and provable levels of anonymity, and to stake out a position defensible in the long term, is to develop more collective anonymity protocols and tools. It may be necessary to constrain the normally individualistic behaviors of participating nodes, the expectations of users, and possibly the set of applications and usage models to which these protocols and tools apply. Toward this end, we offer a high-level view of the Dissent project, a “clean-slate” effort to build practical anonymity systems embodying a collective model for anonymous communication. '''

1 0

Re: [cryptome] Re: 2,940,525 Diplomatic PDFs
by coderman 28 Dec '15

28 Dec '15

On 12/28/15, John Young <jya(a)pipeline.com> wrote: >Cryptome disavows this senselessly bloated and mirrored material, >and all like it junking up the Internet like space debris. "CRYPTOME: ABRIDGED & CONTENTIOUS - 2015 Ed." - Only the most censored, DMCA'd, and potentially illegal documents! This hand crafted collection curated with care for your digital derring do's and counter-culture cred, FOR A LIMITED TIME ONLY - NOW ON IRONKEY NSA-PROOF MILITARY GRADE USB STORAGE DEVICE!!! Please send $499.95 cash or gold bullion to cover hardware and duplication and fine scotch costs; shipping and handling included. Mike Best need not order, the fucker... - John Young 251 West 89th Street New York, NY 10024

1 0

NSA Museum Library has provided "Hagelin M-209 Cryptanalysis from Ciphertext Alone"
by John Young 28 Dec '15

28 Dec '15

NSA Museum Library has provided "Hagelin M-209 Cryptanalysis from Ciphertext Alone," Reeds, Ritchie, Morris, 1978. <https://t.co/MbE5UNMtzb>https://cryptome.org/2015/12/ReedsTheHagelinCipherBellLabs1978.pdf NSA would not release it under FOIA, claiming it was a private paper. Back story: http://bell-labs.com/usr/dmr/www/crypt.html

3 3

Re: surveillance side effects - sometimes with thrill ride included!
by coderman 28 Dec '15

28 Dec '15

On 12/12/15, Shelley <shelley(a)misanthropia.org> wrote: > Greetings coderman, > > Sent off-list intentionally, which I hope you will excuse. I didn't want > to make ASSumptions about your post as I once have in the past :p :P belated reply, as this account is now working again after period of inaccessible. (see below) > Also, if this is a personal anecdote, I didn't want to cause any potential > embarrassment/etc. > > If this isn't a personal anecdote: do you have a link? "so, that happened..." -> https://ello.co/ohj2eevi/post/AcOPfljWjTmfuFEkpc5Pbg > If this is a personal anecdote: do you think it's retaliatory harassment > because of your Muckrock FOIA requests? If so, that's truly fucked up - > but I'm glad you let them know that you know, if it is a personal anecdote, truly fucked up... yeah. you could say that! ---begin-forward--- --- access to this email account is back as of this morning, finally. almost everything on the network inaccessible under "Disruption Strategy" tactics that began last week during this event. this appears to be the request at issue: (or at least the one which pushed a response in turn) https://www.muckrock.com/foi/united-states-of-america-10/kleptokeymgmt-2120… "Procedures, instructions, relevant materials regarding the proper handling of SSL/TLS secret key material obtained pursuant to court order under any authority." Refused as too vague, then I appeal: ''' Per your request for fix of this request, Under the USA PATRIOT Act, Pub. L. No. 107-56 §505(a), 115 Stat. 272, 365 (2001) , including recent revisions; C.f. USA FREEDOM Act of 2015, Pub. L. No. 114-23, 129 Stat. 268, the FBI can issue National Security Letters requesting specific business record information, including SSL/TLS private keys used in Internet communications. See https://peertech.org/files/merrill-v-lynch-unredacted-decision-vacating-gag… for additional information. I am requesting Procedures, Instructions, and any other materials regarding the proper handling of SSL/TLS secret keys obtained via National Security Letters or Court Order under PATRIOT Act, or USA FREEDOM Act authorities as above. Thank you! ''' (quick side note: above you see i linked to a PDF on my server, https://peertech.org/files/merrill-v-lynch-unredacted-decision-vacating-gag…. logs show that only my test requests on Dec 1st retrieved this document, however, it is possible that requests were made that were subsequently erased by the attacker once they obtained private keys giving the ability to MitM connections to the server itself. it is not clear to me if intent to remove evidence was part of this brash compromise.) on the 9th, when reply outbound from agency, a series of events occurrs that results in the compromise of the peertech server and deprecating many keys. this includes all attempts to download taobios-v2.tar.bz2 failing very early in the download - i suspect but cannot prove, that downloads on the 10th, 11th, and 13th were maliciously tampered with, and served to clients by impersonating peertech.org. i have put out a call for copies of these files if anyone kept them from those days. i was able to use Ello and hidden services while under attack. this is the first non-onion service that passed muster under this threat level. thus i wrote about the details there: https://ello.co/ohj2eevi/post/AcOPfljWjTmfuFEkpc5Pbg also, after identifying the FOIA above as contentious, i filed: https://www.muckrock.com/foi/united-states-of-america-10/procpeernotesbye-2… for the processing notes. apologies for any trouble i may have brought your way. i can't believe they're attacking my friends to compromise my systems. (!!!) best regards, and my apologies, martin ---end-forward--- P.S. burning sweet BIOS sploits as per the archive which is back up probably didn't help their mood either. > because [ typing with middle fingers ] fuck them [ /middle fingers ] for > trying to block out the sunlight on their shady goings-on by being even > more shady! this is how to respond properly to intimidation :) > If you choose not to reply, I understand. Know that your efforts are very > much appreciated, and if you are being harassed by retaliatory surveillance > > I hope you will seek assistance from the EFF, EPIC and ACLU. they're pretty out gunned against NSA and NatSec deep state, but i appreciate their efforts. i never understood just how uphill a fight these areas of national security law are to argue before the courts until last few years. truly david and goliath levels of imbalance of power. best regards, P.S. while i am revoking GPG keys out of abundance of caution, only secrets on peertech.org itself were compromised. See list of keys and things to copy copiously at: http://70.85.129.98:443/ http://hackers22mysy6vg.onion/ http://hackers22grhtyvg.onion/ http://hackers23vzyoixr.onion/

4 4

0x962B3498EDF0A585-coder.pub.txt
by coderman 28 Dec '15

28 Dec '15

1 0

Re: [tor-talk] A curious email from Twitter mentioning Tor Project
by Shelley 27 Dec '15

27 Dec '15

On December 26, 2015 2:23:25 PM juan <juan.g71(a)gmail.com> wrote: > > it's the same dumb scam that fukerberg is doing. A while back > the facebook cunts launched the same psy-op. Hey, we have > 'information' that an evil state is 'attacking' you, but that's > all we can say. Of course, it's understood that the attacker is > russian, chinese, or arab terrists, or something like that. > > And captain americuntwitter is saving you! Aren't you glad > that you live in a liberal democracy? > This comment made me smile. It echoes my sentiment perfectly, too. -Shelley (Meant to post this to the list also - sorry, Juan!)

1 0

Re: [tor-talk] A curious email from Twitter mentioning Tor Project
by grarpamp 26 Dec '15

26 Dec '15

On Thu, Dec 24, 2015 at 6:32 AM, kytv <kytv(a)riseup.net> wrote: quote jens: https://twitter.com/qbi/lists/statesponsoredattack2015/members > After a couple of weeks (and finding no more than 46 confirmed "Persons > of Interest (by 'State Actors')", I'm at a loss as to why we received > it. Looking at the list members and our posts, nothing stands out as > being noteworthy. Except for the fact that there are a lot of privacy sphere and opensource contributors there. Various actors would definitely want to attack and infiltrate such things. #opsec y'all.

5 5