- cypherpunks - lists.cpunks.org

6sxoyfb3h2nvok2d
by grarpamp 21 Feb '16

21 Feb '16

Sign a message to me...

1 0

Re: [Fwd: Multiple Internets]
by wirelesswarrior＠Safe-mail.net 21 Feb '16

21 Feb '16

-------- Original Message -------- From: Ted Smith <tedks(a)riseup.net> Apparently from: cypherpunks-bounces(a)cpunks.org To: cypherpunks(a)cpunks.org Subject: Re: [Fwd: Multiple Internets] Date: Wed, 10 Feb 2016 12:02:57 -0500 >I'm a little skeptical of wireless mesh networks as a general solution to this sort of problem, because they're inherently chatty, and have very limited reach. Wireless meshes are usually short range but there is no architectural reason they can't be linked by LoS or even longer distances connections. One area familiar to hams in the VHF/UHF bands is troposcatter. Tropo is similar to the more common HF phenomenon ionospheric reflection ("skip") but instead uses refraction changes in lower layers of the atmosphere due to temperature/density differences. Tropo is shorter range (generally 100-500 km) than skip and less RF efficient but tends to be more reliable and because it operates using much higher frequencies can support much higher bandwidth (data rates). All the VHF/UHF ham bands and several unlicensed bands (900 MHz, U.S. only), 2.4 GHz and 5.7 GHz can all support tropo though reflection efficiency tends to be greatest at the lower frequencies. Until the advent of satellites tropo use was widespread by commercial and military. Now that anti-satellite tech is becoming more widespread (e.g., recent Chinese launches) tropo is again being investigated http://www.militaryaerospace.com/articles/2013/07/army-troposcatter-communi… I'm considering tropo experiments in one of the ham or ISM bands. Please PM if you might have SDR or RF skills, time and some money to throw toward this. Speaking of skip, in my PP Hacker Conference slides http://s000.tinyupload.com/?file_id=03580328025747098705 I discuss a variant, NVIS (Near Vertical Incident Skywave), first developed by the Germans during WW II, which allows HF stations operating between 2 - 12 MHz to bounce signals off the ionosphere for intermediate rage (25-100 km) non-LoS communications. WW

4 6

Re: Apple Vs FBI: We tried to help the FBI but someone changed phone's iCloud password
by Rayzer 21 Feb '16

21 Feb '16

Digitalfolklore wrote: > remember the apartment was never secured...maybe the password was > written down on the back of a receipt that got tossed out when the > apartment was over run by press > > VH > Or something stoopid like that. A few years ago when I was still writing news copy for an alt radio news personality I was personally following the Waxman investigation into Blackwater. Publicly over the Nisoor Square shooting, but they were going to cover other issues behind closed doors such as Blackwater's gun-running (CPA Glocks w/o serial numbers to Turkish city crime gangs for a start), which had been followed by McClatchy news service, and I was using their copy on my blogger posts. One morning, right before the hearings were about to begin, I was checking my site counter and discovered a hit from PentagonMil on one of those posts... What? Me worry? But what followed next should disturbing to anyone who thought the feds understood infosec or had someone on payroll who understands. Apparently the person who viewed it first saved it to their desktop complete with the site counter jscript, and the next few hits after that, instead of showing a typical http path, showed the path through pentagonmil to the desktop names of people the original viewer had passed the page around to. The pentagon was letting my saved blog page 'phone home'. They hadn't blocked outgoing script action. Pretty pitiful hunh? RR "Through counter-intelligence it should be possible to pinpoint potential trouble-makers ... And neutralize them, neutralize them, neutralize them" > >> -------- Original Message -------- >> Subject: Apple Vs FBI: We tried to help the FBI but someone changed >> phone's iCloud password >> Local Time: February 21, 2016 6:08 am >> UTC Time: February 20, 2016 7:08 PM >> From: Rayzer(a)riseup.net >> To: cypherpunks(a)cpunks.org >> >> Transliteration... The feds tampered with the phone and apparently >> fucked up their own investigation. >> >> > The idea was to force the iPhone 5C to auto-backup to Farookâs >> > iCloud account. With a legal court order, Apple can and does turn over >> > iCloud data. For some reason, Farook had not backed up the phone for >> > roughly six weeks prior to the attack. The executive said Apple does >> > not know whether the auto-backup was disabled or enabled, but he did >> > say that the previous iCloud backups, which were handed over to >> > investigators, were sporadic. >> > >> > Apple suggested that the FBI take the iPhone 5C, plug it into a wall, >> > connect it to a known Wi-Fi network and leave it overnight. The FBI >> > took the phone to the San Bernardino County Health Department, where >> > Farook worked prior to the December 2, 2015 attack. >> > >> > When that attempt did not work, Apple was mystified, but soon found >> > out that the Apple ID account password had been changed shortly after >> > the phone was in the custody of law enforcement, possibly by someone >> > from the county health department. With no way to enter the new >> > password on the locked phone, even attempting an auto-backup was >> > impossible. Had this iCloud auto-backup method actually functioned, >> > Apple would have been easily able to assist the FBI with its >> > investigation. >> > >> > The executive only revealed this detail to reporters now because it >> > had thought it was under a confidentiality agreement with the >> > government. Apple seems to believe this agreement is now void since >> > the government brought it up in a public court filing. >> > >> http://arstechnica.com/tech-policy/2016/02/apple-we-tried-to-help-fbi-terro… >> >> --

1 0

The leaked Hacking Team emails might be worth searching for public IPs
by Georgi Guninski 21 Feb '16

21 Feb '16

The leaked Hacking Team emails might be worth searching for public IPs. https://wikileaks.org/hackingteam/emails/emailid/498702 > openvpn.log:Sun Jan 25 14:54:56 2015 169.229.3.93:40500 MULTI: > multi_create_instance called > openvpn.log:Sun Jan 25 14:54:56 2015 169.229.3.93:40500 Re-using > SSL/TLS context > openvpn.log:Sun Jan 25 14:54:56 2015 169.229.3.93:40500 LZO > compression initialized $whois 169.229.3.92 OrgName: University of California at Berkeley

1 0

Re: [Cryptography] Apple 3rd Party dilemma
by grarpamp 21 Feb '16

21 Feb '16

On 2/20/16, Henry Baker <hbaker1(a)pipeline.com> wrote: > At 11:48 AM 2/20/2016, Viktor Dukhovni wrote: >>On Sat, Feb 20, 2016 at 02:01:10PM -0500, Phillip Hallam-Baker wrote: >>> On Fri, Feb 19, 2016 at 5:19 PM, Henry Baker <hbaker1(a)pipeline.com> >>> wrote: >>> > Apple got themselves into this mess, because Apple wants to control the >>> > customer's phone. >>> > +1 >>> > Yes, that is my belief as well. >>> > Apple set itself up not just as a 3rd party but as an essential, >>> non-replaceable third party. There is no choice but to trust Apple for >>> the iPhone security. >>> > It didn't have to be that way. There could be the option of installing >>> your own root of trust into the hardware. >> >>Except that, in that case, most of the "your own root" installations would >> be some attacker's "own root" installations. >> >>In practice, curated security works better for the vast majority of users. >> >>The vast botnets of Legacy Windows installations are compelling evidence >> that expecting the average user to secure a general-purpose computing >> platform is unreasonable. >> >>You pay a premium price for Apple to take care of the details. > > The *money* price isn't the major problem; the problem is the *3rd party > doctrine,* which gives the NSA/FBI/DHS/DOJ easy/trivial access to your > "cloud" data. Look at how easy FBI/DOJ obtained the cloud backups of > Farook's iPhone. > > The only solution is to store only fully encrypted data in the cloud; but if > you lose your iPhone or the key, it's gone. > > It's also gone if you (or the govt) goes beyond 10 guesses; so the govt has > an easy DoS attack on your data: have the TSA screw with your phone every > time you cross the border. > > Hey, hey, you (govt), you (govt), get off of My Cloud! Even the laborer these days knows some concept of backups and security, regardless if they have any clue or motivation to do it. There's zero reason now why hardware makers cannot include a binary option: a) i'm stupid, for now just show me knowledge about secure mode b) ok, instantiate non-nanny-state secure mode or a) your device ships in secure mode b) do you want to be nannied Any maker that gratuitously retains control for whatever purpose and does not provide this does not believe in empowerment, and is thus shameful.

1 0

"network shock-testing"-resistant data serving
by Zenaan Harkness 21 Feb '16

21 Feb '16

Answers anyone? I know wikileaks has a bad name with some, but let's set that aside, since I think it is an easy concept for lay people to understand, and to discuss this particular network challenge. Hypothetical: - I have a large a juicy data set leak, a particularly gruesome and indicting of the establishment, mil video. - I can upload it piecemeal and from varied and "random" locations, pre-scouted to be sure there are no surveillance cameras to monitor my piecemeal uploads. - But ultimately the result exists on some server, to serve up this juicy media frenzy fueling firetruck for the govt. - So downloaders can be "network shock tested" by interrupting the stream (with say a forged onion site), and voila - the end user for that particular stream is identified. - Similarly, downloading from the original/ non-forged onion site, say 100 'simultaneous' downloads, and I (network global viewer) can simultaneously stop all downloads and watch which physical host has a drop in outgoing load. So these are two problems - network shock-testing the end-user downloader, and network shock-testing the server uploader (no point having a juicy leak vid if you don't upload it to people for viewing). The only potential/ partial solutions I've heard so far: - pervasive fill traffic - hybrid/ alternate physical network Anyone got any other ideas and/ or elaboration on these potential partial solutions?

1 0

Global Governments To Kill Cash
by grarpamp 21 Feb '16

21 Feb '16

https://www.washingtonpost.com/news/wonk/wp/2016/02/16/its-time-to-kill-the… http://www.hks.harvard.edu/content/download/79140/1776759/version/1/file/El… https://www.reddit.com/r/btc/comments/462v8u/andreasmantonopoulos_on_twitte… https://twitter.com/aantonop/status/699610460279197697

1 0

Biometrics police training video
by Michael Best 20 Feb '16

20 Feb '16

New release through MuckRock/Michael Morisy: https://www.muckrock.com/foi/polk-county-204/mobile-biometric-technologies-… -- Veritas aequitas liberabit vos Veri universum vici That 1 Archive <http://that1archive.neocities.org/> @NatSecGeek <https://twitter.com/NatSecGeek> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: SKS 1.1.5 Comment: Hostname: pgp.mit.edu mQINBChG9zoBEADKzALG4UHCjY6L9OFUxWRVGGCW7LY71K2EAK/0jkRh1wPkJ4chPaVJ3vVD nJ0d8HxsyR5R3+y7GH6GCc/tK0IDPJah+xpQnraS1nWUvAlSaaxsBK4hJfuVGyfBg/joQVKU OhpqJLQhRIkUWk30QC94IbOKiCTb6V4pStLYyrLieewjT481vvRIYp/48IS5eiveZW0/IpcA HBON7xJw6P1murC8PNOJSWRCp9FJhcs3wIPG3cFTfsxSZnGcoivMgFLtGAfLbztpZkcHEMOR 4qamVvirzYGHma0UlOzyNr7xpxyLXFsU5kKzQ8Az2nP1GG7vuqXSjPNLIvvHFL+g+gKuCe9W xTa9Ac038RRSiBGdDrvTFpQ/h9h5GWIHP7nsA4TCeZSpL81aqp7Cb0MK3KPQmteTPIujVCnx jXXHrOe9Tj6iYUU8edApISyBEVFZMd+EtfDEDf/ZwDjzSGE85vv1dZ/ck7iJvS8FwM8hsRBG U9huCKiItGs26teUJ2Sum49YaEiDL4QLQhJ+FbsAusxJg+V3GE/4w75K/6/czT0p10Mf66Uo fRFTvYRE7S6CNDxzTI4q7+pnRlxMBduGC33KY4eq4Py/O3LWHBDxZ+LffIa/tWcB/7oZ6yDo bdWleNk5wnJdPGr6lUTHTM4tpDIEcXYpvjzyLcMtg4tFm/Dc0QARAQABtGVNaWNoYWVsIEJl c3QgKFByaXZhdGUsIG5vdCBzZWN1cmUuIEZvciBzZWN1cmUgZW1haWwsIHJlcXVlc3QgYSBv bmUtdGltZSBrZXkuKSA8dGhlbWlrZWJlc3RAZ21haWwuY29tPokCPQQTAQoAJwUCKEb3OgIb AwUJNXc1AAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRCiYH9hY4dAS3e+D/sFwyJER4/4 ZnHYC/1EzCpHeDikSmULEgsvNgzo73thOV9/Q2I8mCJTlQjsK4rZ2YiDzi4b0CN8kzjpxtVz BsBsxfyPLrdH4VoqeqeBVzbwHxSk7bYUI3vFt+e3gBgpAxbVfPXCnYUnWPRlr9dc/JZoPJH4 p8yRIqktehbAE3Fa3gkfrXJ5e6+/nKlQhikyvo9VuErrLpPMXBzOq4/2LVfurkcOzlp1RBjs hWr6B98EiOXs44ZGLEkINxJiW8koFhw/WDuON8LKi/DtLiqqtBVTjrkqKCuKzSAVncGGcEVO 3Om3aOIOvG0do/wQKYXnpbeGsHwx2PGrJ7H+lb2bIb5KhbZkbG4rMTjsVnuGN+IF4BxBhmGz MYoooWy4VCLL0o8keomU8JPXt+fZDqJ9sNjY/asTsjOa6aE3bIa6w3mWUeefGwA25oXur3Rr L3wmu1pPzCejumfA1X93dS9UZS3xni+7W34g6YbsREuaZ+YBxFLN227JXAx2pEdjLsuVOaqM 9CO7ARHsxDZoE9U7n0s3txnSw/2YYwjEK1wDhdLnHBL3ZzaAcaHnpzsTYQAVW7uXKKHhzeSK GP3O4ByCisM/7WLFvIIpaNNs85jI1PvKH0GutSTl9xXDfWuYMl9rwwbteBB/oGSxlIFe0pqq IDNfAJdR/HjTLqrTES2wdXJS1bkCDQQoRvc6ARAAmltXrhVfpePdIFrfEHCet4nkQvmRI+AX rUgiNlxQDW8M5FzlUfT2xpMXHMWuKehTYpFq7bNbFi+fwBhMajgvgDsTuLInftKSFp+sisbR n8psv7CpGB4jp0Xd4y1Wm/HejV/kga0kcUVVetaqyzgZedn1UnccQRzDBVWW2j2ed+hi/8g0 /d7mbVG81yzJo8tLidM90xFF7JGlijm0dBAqmhD4UgkxSnJQ3PK5onqdjdbx7HkP68RrkeTQ vhWK1978qzdSl9ljJ0jLnoAaDNPs5Dj/TyYCtqoKHUqMbTwU5nIQnJG7geMeSw/7OVnKlypF Rs/JesZzMBooZTRxZJuIB/q0wOfE/MYTwGSwLs2brUwJFJ6bSYmerZ+81S8W/Y4mehJ3o6Vl SabrrVN+LlBfUuRqd5U909WECzk6HVnwnRfL07zD+1y5cLU+e4MQs2227kLriTIxtDZ/umeG hKQgNgFGTAPHJxA96xGvQ8Ovv+XEivlO0jxBNMIiopNSlMDE+k3nigWHuavt9LUUCOd45aw7 0pgKstQQgpFfVAwV98LPpUKxa61q6wQiQHAcP7YxuQG0dsr4nUq2xids5l1IpOLzZJ3nRThM k7alkljBbqphbocV3FsSXOkpcSWns94k1QGmrPzEPLF0FHFBG6whWoaoEySMkdsN1zVu4GMU o2EAEQEAAYkCJQQYAQoADwUCKEb3OgIbDAUJNXc1AAAKCRCiYH9hY4dASzTaEACKXVgc8KmZ xWyYTUQgIwrj3J/re68uIilq0iBBDocgEZZpxyf6lD1V3IKBjAPpWyYHMrrrLY64rFDR+8DE Xyhm1Wv2S6YJuWJtyAlS4bciXjJE6evirIH5GoFq++vzsufRaudAoQ56hJ0+Z3dNMMWZ6YuP zWNNL2tvpdo3Nvd8bqiADWSffFdIPv5Yj/mZsXmaDN+7iWYlAdCrubGyGzFHlCh26Ghu6SS0 /u8x1/Oi7ma7fUMFnEsFiYjwBkD3pQKK1dm7j2f1OMxi8uky8vgBgx40aeJkoUgEvIHWsCIi CWVTyfiGeWIcKbK7tYP5jsjV5fUv+TaQ1pApt++Pyop1aogfQ8icNBQQkdX6E4gNhnPOPTM8 FTl69Tq5Ori5+TM8VM0iPGiydlcAXIAD3OyR4tZM12Ga1AtppKjx31EyDB4SPzUmDWRy5WgG NRH3+RgiK/iXVcvLdFIKj3/AvctSLdbayyaFD8zrE/wcMzLfie+iE231+rG/7gmcR3H1rcYE vxvmWAPikLQKiMUpPBNSvfLPUTrwNSGiZ5ieAAPgOooc3u5nohwZmEW1pg6HirZgIAgAYuyL aLgnikwH70guiQ4Ufsih3gy0ddsUwliUTtbYQyX0OBQoTUyaiXPy0Wu2FJfsxiW8X9Lu9pIH KOwU9K76VKot+UikGqeFQsS/Ig== =M+du -----END PGP PUBLIC KEY BLOCK-----

1 0

The Intercept steps up after catching a reporter faking data and sources
by Michael Best 20 Feb '16

20 Feb '16

https://theintercept.com/2016/02/02/a-note-to-readers/ Short version: One of their reporters was being dishonest, they caught it and fired them and have retracted one story and corrected several others. It's nice to see they're trying to be accountable and aren't hiding their mistakes (AFAIK, they caught it before anyone else did and so weren't just "getting in front of things" to preempt an outing) Kudos, Intercept.

9 43

(no subject)
by John Young 20 Feb '16

20 Feb '16

If Apple can hack its own security then the products are backdoors.

8 8