- cypherpunks - lists.cpunks.org

Drivels on OSS security about CVEs
by Georgi Guninski 19 Mar '16

19 Mar '16

There is some drivel on OSS security about CVEs: http://openwall.com/lists/oss-security/2016/03/04/4 I have trolled on numerous occasions that CVE and mitre suck much, e.g. a post from 2006: http://seclists.org/fulldisclosure/2006/Jan/259

1 0

Google: 'We'll pay $100K if you can hack a Chromebook remotely'
by Rayzer 18 Mar '16

18 Mar '16

> The move doubles last year's top reward of $50,000, available > exclusively for attacks that achieve a persistent compromise on a > Chromebook in 'guest mode' http://www.zdnet.com/article/google-well-pay-100k-if-you-can-hack-a-chromeb… -- RR "Through counter-intelligence it should be possible to pinpoint potential trouble-makers ... And neutralize them, neutralize them, neutralize them"

3 2

New video on Ethereum at Reason.com
by jim bell 18 Mar '16

18 Mar '16

http://reason.com/reasontv/2016/03/18/ethereum-blockchain-lubin-consensys A very well-done video on the Ethereum blockchain-based network, by Jim Epstein of Reason Magazine. Jim Bell

1 0

Safe country for crypto products
by strife 18 Mar '16

18 Mar '16

Hi! Looks like, rather sooner than later, we will have to move some products to other countries. AnyDVD, which has slightly different enemies, moved from Switzerland to Antigua to Belize. Looking at the slightly outdated cryptolaw.org, I wonder which non-EU/non-US country would actually be suitable to serve as host organization for open source crypto projects. With some thinking, it probably can be arranged to have parallel entities in multiple countries 'responsible' for an open source project. I can't think of any examples where this is the case, most projects do have one primary legal home (trademark, copyright, etc). Suggestions?

4 3

USG-Apple - 3/22/16 Hearing Procedures, Add 3 USGs
by John Young 18 Mar '16

18 Mar '16

USG-Apple - 3/22/16 Hearing Procedures, Add 3 USGs https://cryptome.org/2016/03/usg-apple-181-184.pdf

1 0

ZDNet: "US government pushed tech firms to hand over source code"
by grarpamp 18 Mar '16

18 Mar '16

---------- Forwarded message ---------- Date: Thu, 17 Mar 2016 14:21:24 -0400 Subject: [Cryptography] ZDNet: "US government pushed tech firms to hand over source code" To: cryptography(a)metzdowd.com NEW YORK -- The US government has made numerous attempts to obtain source code from tech companies in an effort to find security flaws that could be used for surveillance or investigations. The government has demanded source code in civil cases filed under seal but also by seeking clandestine rulings authorized under the secretive Foreign Intelligence Surveillance Act (FISA), a person with direct knowledge of these demands told ZDNet. We're not naming the person as they relayed information that is likely classified. With these hearings held in secret and away from the public gaze, the person said that the tech companies hit by these demands are losing "most of the time." http://www.zdnet.com/article/us-government-pushed-tech-firms-to-hand-over-s… _____________________________________________ http://www.metzdowd.com/mailman/listinfo/cryptography

2 1

blockchain startup
by dan＠geer.org 18 Mar '16

18 Mar '16

Good team... Freemit (New York City, NY) http://www.freemit.com Freemit is creating an alternative to current remittance and currency exchange systems. It uses the blockchain and a local currency in/local currency out service, along with a phone app and virtual credit card, to simplify and streamline cross-border money transfers.

3 2

Apple GovtOS/FBiOS & Proof of Work
by grarpamp 18 Mar '16

18 Mar '16

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Thu, 17 Mar 2016 17:39:22 -0700 Subject: [Cryptography] Apple GovtOS/FBiOS & Proof of Work To: cryptography(a)metzdowd.com If Apple is willing to put some serious Proof of Work into constructing *every* firmware update, then it could achieve some level of privacy: When constructing a firmware update, the SHA512 (or better still, some Apple proprietary) hash of the update has to have some preset number of '0' bits. So Apple will have to brute force fiddle with bits in the firmware load to achieve an appropriate hash. The work involved should grow exponentially in the # of '0' bits required. Most companies operate on a fixed update schedule, so Apple would have to plan every release far enough in advance to give Apple enough time to compute such a firmware load. The reason for an Apple proprietary hash is so any attacker would have to build their own custom chips to be able to beat Apple at this Proof of Work game. Note also, that Apple can *change* the hash function on every firmware update, so said custom chip would be useful for only one firmware release. The firmware loader of course refuses to load any firmware whose hash doesn't have the appropriate number of '0' bits (along with the standard Apple signing key checks, etc.). The hash also incorporates the previous firmware load a la Merkle, so if your firmware is ever compromised, your iPhone is forever bricked. The hardware loading code refuses to load the first block of the new firmware anywhere but right on top of the user's file encryption key. So the *default* for the firmware flasher is to always *forget* this key, unless very special arrangements are made to save this key in other places. This key is further encrypted and broken into many pieces prior to moving it out of the way of the firmware loader (including into the CPU's volatile register memory, so any power disruption will destroy some of this key). Of course, much like a password hashing function, such Apple hash functions would be designed specifically to be *slow*, so GPU's and gate-arrays would be of no particular value. With a proper PoW system, any attacker would have to spend at least as much time as Apple themselves to create a loadable firmware, and that time might be as long as 6-12 months. A scalable way for Apple to dominate any attacker (including most nation-states) is to utilize the *entire installed base* of Apple products (estimated by Tim Cook to be >1 billion devices) in a distributed calculation. Thus, Apple could use its "herd" itself to provide for "herd immunity" to firmware update attacks. iPhone users would notice if Apple were attempting to compute >1 firmware update PoW at any given time! A 6-12 month lead time (during which the PoW for GovtOS is being computed) would give Apple plenty of time to respond to any legal issues and warn other Apple customers of an impending breach-of-trust in the firmware update chain. If Apple is issued an NSL and can't talk about it, 6-12 months would still be a long enough delay to deter all but the most persistent of govts. Even Napoleon refused to look at any messages until they were at least 3 days old; he found out that 99% of these messages resolved themselves without any action on his part -- e.g., "please pardon my son; he is to be executed in the morning". If Apple speeded up or slowed down its pre-announced firmware update schedule, that change itself would provide an excellent "warrant canary". <Apple: please reference this public email in your patent applications. Thx! -- Henry Baker> _______________________________________________ http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: [tor-talk] Latency Spike
by grarpamp 18 Mar '16

18 Mar '16

On 3/17/16, poly <poly(a)darkdepths.net> wrote: > Could anyone please explain the reason behind this spike [0] to me? > > [0] https://metrics.torproject.org/torperf.png?start=2015-12-18&end=201 > 6-03-17&source=all&filesize=50kb That's the NSA giving you the finger...

1 0

Philosohpical - Reading between the lines: the Great War of Continents, information wars, and multipolarity
by Zenaan Harkness 17 Mar '16

17 Mar '16

Speaking of agendas, of course we each tend to see the world, the struggles of the day, through particular lenses, preferences, agendas etc. This philosophical piece has an image which could make a great desktop background - but more importantly may help remind some (such as I) to take note of the breadth of viewpoints/ agendas from which we may couch any events of the day. Perhaps you might enjoy it too. http://fortruss.blogspot.ru/2015/11/reading-between-lines-great-war-of.html Regards, Zenaan

2 2