- cypherpunks - lists.cpunks.org

[cryptography] open letter to Phil Zimmermann and Jon Callas of Silent Circle, re: Silent Mail shutdown
by Eugen Leitl 20 Aug '13

20 Aug '13

----- Forwarded message from Zooko Wilcox-OHearn <zooko(a)leastauthority.com> ----- Date: Fri, 16 Aug 2013 21:46:10 +0000 From: Zooko Wilcox-OHearn <zooko(a)leastauthority.com> To: cryptography(a)randombit.net Subject: [cryptography] open letter to Phil Zimmermann and Jon Callas of Silent Circle, re: Silent Mail shutdown also posted here: https://leastauthority.com/blog/open_letter_silent_circle.html This open letter is in response to the `recent shutdown of Lavabit`_ , the ensuing `shutdown of Silent Circle's “Silent Mail” product`_, `Jon Callas's posts about the topic on G+`_, and `Phil Zimmermann's interview in Forbes`_. Also, of course, all of this is unfolding in the context of the `2013 Mass Surveillance Scandal`_. Dear Phil and Jon: Hello there! It is good to have a chance to chat with you in public. Please accept the following in the spirit of constructive criticism in which it is intended. For those readers who don't know, I've known you both, personally and professionally for decades. You've each written texts that I've learned from, inspired me to follow your example, we've worked together successfully, and you've mentored me. I have great respect for your technical abilities, your integrity, and your general reasonableness. Thank you for the all of that and for holding fast to your principles today, when we need it more than ever. Now: Your job is not yet done. Your customers are currently vulnerable to having all of their communications secretly monitored. I just subscribed to the service at https://SilentCircle.com, and after I paid $120 for one year of service, it directed me to install the Silent Text app from Silent Circle on my android phone, which I did. Now, when I use that Silent Circle app to send text messages to other Silent Circle customers, I have no way of verifying whether it is really encrypting my message on my own phone, and if it is really keeping the encryption key only for me, or if it is leaking the contents of my messages or my encryption keys to you or to others. If some attacker, for example the U.S. Federal Government — or to pick a different example the Zetas Mexican drug cartel — were to coerce Silent Circle into cooperating with them, then that attacker would simply require Silent Circle to distribute an update to the app, containing a backdoor. There is no way for me to verify that any given version of Silent Text, including the one that I just installed, is correctly generating strong encryption keys and is protecting those keys instead of leaking them. Therefore, how are your current products any safer for your users that the canceled Silent Mail product was? The only attacker against whom your canceled Silent Mail product was vulnerable but against whom your current products are safe is an attacker who would require you to backdoor your server software but who wouldn't require you to backdoor your client software. Does that constraint apply to the U.S. Federal Government entities who are responsible for PRISM, for the shut-down of Lavabit, and so much else? No, that constraint does not apply to them. This was demonstrated in the Hushmail case in which the U.S. DEA asked Hushmail (a Canadian company) to turn over the plaintext of the email of one of its customers. Hushmail complied, shipping a set of CDs to the DEA containing the customer's messages. The President of Hushmail `emphasized`_ in interviews with journalists at the time that Hushmail would be able to comply with such orders regardless of whether the customer used Hushmail's “client-to-server” (SSL) encryption or its “end-to-end” (Java applet) encryption. .. _emphasized: http://www.wired.com/threatlevel/2007/11/hushmail-to-war/ Phil had been Chief Cryptographer of Hushmail years earlier, and was still a member of the Advisory Board of Hushmail at the time of that case. He commented about the case at that time, and he also `stated`_, correctly, that the Hushmail model of *unverified* end-to-end encryption was vulnerable to government coercion. That's the same model that Silent Circle uses today. .. _stated: http://www.wired.com/threatlevel/2007/11/pgp-creator-def/ You have just taken the courageous act of publicly shutting down the Silent Mail product, and publicly stating your reasons for doing so. This, then, is your opportunity to make your stance consistent by informing your customers of the similar dangers posed by the software distribution practices currently used by Silent Circle (along with most of the rest of the industry). I don't know the perfect solution to the problem of the *unverifiability* of today's software. But being frank about the current approach and the vulnerability that it imposes on users is the first step. People will listen to you about this, now. Let's start talking about it and we can start finding solutions. Also, warn your users. Don't tell them the untruth that it is impossible for you to eavesdrop on their communications even if you try (as your company seems to be on the borderline of doing in public statements like these: [ `¹`_, `²`_]). .. _¹: http://www.forbes.com/sites/parmyolson/2013/07/15/corporate-customers-flock… .. _²: http://techcrunch.com/2013/08/08/silent-circle-preemptively-shuts-down-encr… We're trying an approach to this problem, here at LeastAuthority.com, of “*verifiable* end-to-end security”. For our data backup and storage service, all of the software is Free and Open Source, and it is distributed through channels which are out of our direct control, such as Debian and Ubuntu. Of course this approach is not perfectly secure — it doesn't guarantee that a state-level actor cannot backdoor our customers. But it does guarantee that *we* cannot backdoor our customers. This currently imposes inconvenience on our customers, and I'm not saying it is the perfect solution, but it shows that there is more than one way to go at this problem. Thank you for your attention to these important matter, and your leadership in speaking out about them. (By the way, LeastAuthority.com is not a competitor to Silent Circle. We don't offer voice, text, video, or email services, like Silent Circle does/did. What we offer is simply secure offsite *backup*, and a secure cloud storage API that people use to build other services.) Regards, Zooko Wilcox-O'Hearn .. _recent shutdown of Lavabit: http://boingboing.net/2013/08/08/lavabit-email-service-snowden.html .. _shutdown of Silent Circle's “Silent Mail” product: http://silentcircle.wordpress.com/2013/08/09/to-our-customers/ .. _Jon Callas's posts about the topic on G+: https://plus.google.com/112961607570158342254/posts/9uySMokvg7k .. _Phil Zimmermann's interview in Forbes: http://www.forbes.com/sites/parmyolson/2013/08/09/e-mails-big-privacy-probl… .. _2013 Mass Surveillance Scandal: https://en.wikipedia.org/wiki/2013_mass_surveillance_scandal _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Fwd: Freedom Hosting Owner Arrested, Tormail Compromised, Malicious JS Discovered
by David Vorick 20 Aug '13

20 Aug '13

It's possible that the attack in the paper isn't perfectly effective. It's also possible that the government isn't aware of the paper, or at least hasn't organized enough yet to mount an attacked based off of this paper. (some beauracrat in power is spending money on this piece of malware, wants all resources behind it, or maybe other political bullshit, and so as always the government is slowing itself down) And finally, it's possible that TSR uses additional layers of protection, like VPN through countries outside of US jurisdiction, so that even when you unwrap tor TSR remains hidden. On Mon, Aug 12, 2013 at 9:46 AM, David Vorick <david.vorick(a)gmail.com>wrote: > It's possible that the attack in the paper isn't perfectly effective. > It's also possible that the government isn't aware of the paper, or at > least hasn't organized enough yet to mount an attacked based off of this > paper. (some beauracrat in power is spending money on this piece of > malware, wants all resources behind it, or maybe other political bullshit, > and so as always the government is slowing itself down) > > And finally, it's possible that TSR uses additional layers of protection, > like VPN through countries outside of US jurisdiction, so that even when > you unwrap tor TSR remains hidden. >

7 9

Re: Google to encrypt cloud storage
by John Down 19 Aug '13

19 Aug '13

If memory serves me right, when was revealed information about Colossus 2 (built in 1940x), it was pretty astonishing that it has computation power as very specialised computation device same as compared generic computation device with Pentium platform running C program which is doing same. So they were equal in solving these specific problem of decrypting messages. Now you can make assumptions what they should have very specialised hardware-based for solving tasks of decrypting AES, etc On Mon, Aug 19, 2013 at 11:14:52AM +0000, Lodewijk andré de la porte wrote: > AES-128 is obviously not secure enough against NSA-type attacks. It works > against the random raid of the servers, the exploitative sysadmin and > perhaps even the remote exploit in the software. It also allows Google to > run storage nodes at a lower security level, which might help them smooth > operations. > > Nothing there to help against the agencies.

1 0

MailPile: self-hosted webmail with built-in PGP/GPG
by rysiek 19 Aug '13

19 Aug '13

Hi there, As the topic states -- there's a neat project of a webmail that has PGP/GPG support built-in from the start with the idea of making it as easy to use as possible (or more). MailPile: http://www.mailpile.is/ There's an IndieGoGo campaign to fund its development, 3/4 funded already: http://www.indiegogo.com/projects/mailpile-taking-e-mail-back -- Pozdr rysiek

1 0

see something, say something stamps
by David Honig 19 Aug '13

19 Aug '13

see something, say something US custom stamps Featuring Sysadmin E. Snowden and a typical meme font. Any copyright issues to be aware of? I wish to God these calculations could be done by a steam engine," Babbage complained

9 8

Re: Is the Wikileaks Party a cypherpunk party?
by John Young 19 Aug '13

19 Aug '13

Cryptome beats its stick frustrated in a dim cotton pick weigh shed. WikiLeaks wails, release me, dog-fuck-stuck in a worldwide power grid. Manning and Snowden got the humongous brass balls leak exploiters lack exactly like leaker defenders and fans. At 11:17 PM 8/17/2013, you wrote: >On Sat, Aug 17, 2013 at 7:52 AM, John Young <jya(a)pipeline.com> wrote: > > I would definitely support Assange and the WikiLeaks Party (if TCM > > and a few stalwart others rebuff a draft) as superior to status quo > > politics enforced by US and allies worldwide. > > >i read this as: "i would rather smash my thumb with a hammer than >stick my dick in a lamp socket"

5 4

Re: Is the Wikileaks Party a cypherpunk party?
by James A. Donald 18 Aug '13

18 Aug '13

On 2013-08-17 8:01 PM, CryptoFreak wrote: > While I'm American, I've been paying close attention to the Wikileaks > Party in Australia. Could it be the political embodiment of the > cypherpunk movement? > > Regardless of what some think of Julian Assange, he certainly holds > true to the cp ethic and the parties belief in accountability, > privacy, and justice, seem well aligned with the movement. > > So what do you think? Is their finally a political party more closely > aligned with the cypherpunk ideal than the Libertarians? > > Regards, > CryptoFreak > Libertarian Party, and its organs, such as "Reason" Magazine, have not been libertarian for some considerable time. As the inner party (Democrats) and the Outer Party (Republicans) continue to move left on racial and sexual differences and on sexual preferences, the "Libertarians" attempt to maintain a a "balanced" position between them - which means that they steadily move left on these issues, adopting ever less libertarian positions, positions that a decade or two ago would have been seen not merely as statist, but as insanely statist. They theoretically support the abolition of welfare and open borders, but actually support open borders with welfare for underclass immigrant bastard spawn, a disturbingly different proposition. In California, we are getting more Indios than Mestizos. They did not work in Mexico, and even less are they working in California. They theoretically support freedom of speech, but repression of speech on racial and sexual differences is just fine by them. They theoretically oppose welfare, but do not actually oppose welfare. They oppose profiling - you are allowed to reason about some matters, but not others. The took a "balanced" position on the Zimmerman case "President Obama spoke some undeniable truths when he noted that the African-American community’s intense reaction to the case must be seen in the context of a long, terrible history of racism" "No one except Zimmerman knows whether he continued to track Martin—or, as he claims, headed back to his truck only to have Martin confront him. No one but Zimmerman knows who initiated physical violence" In fact we have compelling forensic and circumstantial evidence that Zimmerman spoke the truth on both of these questions. Reason Magazine is lying, they are merely lying less egregiously than the rest of the mainstream media. Their position is "reasonable doubt", whereas in fact we have enough evidence to convict Martin Trayvon, a drug addled burglar, had he lived. When discussing this case "Reason" regularly make the pious affirmation that the poor blacks are being victimized by evil whites, while, Martin Trayvon exemplifies black privilege, both in his reaction that Zimmerman dissed him by profiling him as the drug addled burglar that he in fact was, and in that for affirmative action reasons he was not charged with burglary under circumstances where a white boy at the same school would have certainly been charged with burglary. (The government did not like the criminal system having disparate impact on the kids in that school, and were taking affirmative action measures to correct the disturbing fact that lots of black kids were being imprisoned, and few or no white kids - since equal discipline and law enforcement had unequal consequences, they were applying unequal discipline and law enforcement. ) When reason magazine discusses the curious anomalies leading to massively unequal university education for males and females, their explanation for all discrepancies favoring women is that women are wonderful, even though many of these discrepancies are demonstrably the result of systematic discrimination against males and intentional penalization of males for being male. All increases in female representation in academia and decreases in male representation, are, according to reason magazine, sunshine, lollypops and rainbows, a manifestation of the fact that decreases in evil sexism now allow women to demonstrate their true abilities, which are of course equal to men, except that women, being wonderful, are a lot more equal than men.

1 0

[tt] NYT: Microsatellites: What Big Eyes They Have
by Eugen Leitl 18 Aug '13

18 Aug '13

----- Forwarded message from Frank Forman <checker(a)panix.com> ----- Date: Tue, 13 Aug 2013 21:19:39 +0000 (GMT) From: Frank Forman <checker(a)panix.com> To: Transhuman Tech <tt(a)postbiota.org> Subject: [tt] NYT: Microsatellites: What Big Eyes They Have Microsatellites: What Big Eyes They Have http://www.nytimes.com/2013/08/11/business/microsatellites-what-big-eyes-th… By ANNE EISENBERG PEOPLE already worried about the candid cameras on Google Glass and low-flying drones can add a new potential snooper to the list: cameras on inexpensive, low-orbiting microsatellites that will soon be sending back frequent, low-cost snapshots of most of Earth's populated regions from space. They won't be the first cameras out there, of course. Earth-imaging satellites the size of vans have long circled the globe, but those cost millions of dollars each to build and launch, in part because of their weight and specialized hardware. The new satellites, with some of the same off-the-shelf miniaturized technology that has made smartphones and laptops so powerful, will be far less expensive. The view from high up is rich in untapped data, said Paul Saffo, a forecaster and essayist. He expects the new satellite services to find many customers. Insurance companies, for example, could use the satellites' "before" and "after" views to monitor insured property and validate claims after a disaster. Businesses that update online maps for geologists, city planners or disaster relief officials could be customers, too. The images could also be used to monitor problems like deforestation, melting icecaps and overfishing. And food companies and commodities traders could use the images to keep track of crops and agricultural yields all over the planet, Mr. Saffo predicted. But the images are also likely to be viewed as the latest mixed blessing by people already apprehensive of Big Brother-like surveillance in their lives. First into space in the microsatellite business will be the San Francisco company Planet Labs, which plans to launch a fleet of 28 small satellites at the end of the year that will photograph the planet around the clock, with frequent updates. The company has already sent up two trial satellites for test runs, and will dispatch the entire set, called Flock-1, in December, said Will Marshall, a co-founder of the company and a former NASA scientist. The Planet Labs' satellites won't be able to distinguish your face or read your license plate--the cameras don't have that level of resolution. But the frequency with which images can be updated could raise privacy questions, said Timothy Edgar, a visiting fellow at the Watson Institute for International Studies at Brown University and a former director of privacy and civil liberties in the Obama administration. Mr. Edgar contrasted the satellite images with those provided by Google Earth--the ones that people zoom in on to see, for example, an aerial view of their homes."That's just an image of your house that was probably taken a few years ago," he said. "It may feel like you are being watched, but you aren't. It's just a static picture that's most likely several years old." But a satellite that regularly passes over your cabin deep in the woods and photographs a car that is sometimes parked there--and sometimes not--has different ramifications. "It can show a pattern, for example, when you appear to be at home and when you're away," he said. Planet Labs' technology, like that at other microsatellite companies such as Skybox Imaging, are benefiting from the progressive miniaturization of consumer electronic components, along with a federal effort to commercialize space. "What we are seeing are smaller satellites that have similar capabilities to much larger, traditional satellites," said Glenn Lightsey, a professor at the University of Texas who founded and directs the Texas Spacecraft Lab there. "Since putting a satellite in orbit is a function of its size, these new satellites are able to get into orbit at a much lower cost," he said. The lightweight satellites have another advantage: the companies don't have to spend millions of dollars for a rocket to get them into space. Instead, they can hitch a ride as a secondary payload on a rocket already making the trip. Planet Labs will send its satellites on an Antares rocket when it heads out on a cargo transportation flight to the International Space Station. Investors have flocked to the new satellite companies, though neither Planet Labs nor Skybox Imaging has disclosed what it will charge customers. Planet Labs has obtained $13.1 million in funding, led by Steve Jurvetson, managing director of Draper Fisher Jurvetson. Other backers include O'Reilly AlphaTech Ventures, Data Collective and First Round Capital. Five ground stations will receive the Planet Labs imagery as the satellites pass overhead. Dr. Marshall would not disclose how often the satellites would pass the same spot. "The point is that by putting up lots of satellites, we can image the whole Earth on a much more frequent basis," he said. Skybox Imaging, in Mountain View, Calif., aims to provide sharply detailed images as well as high-definition video with its satellites. The company, which has raised about $91 million, expects to put its SkySat-1 and SkySat-2 satellites into orbit later this year, said Dan Berkenstock, a co-founder, and then follow with a group totaling 24 satellites. Customers will be able to buy images or an appliance to download information directly from the satellite. "They can log onto our satellite and ask it to take pictures," he said. Japan Space Imaging, a subsidiary of the Mitsubishi Corporation, recently signed a contract with Skybox allowing it to directly downlink imagery for agricultural and maritime monitoring as well as for disaster response. Microsatellite services promise a new, accessible way to monitor global changes such as crop growth, said Anthony Janetos, director of Boston University's Pardee Center for the Study of the Longer-Range Future. "You can't understand these forces if you can't measure them," he said. "These services will be useful in gathering those measurements." The new satellites are yet another stage in the expansion of the human view aided by powerful cameras and digital communication, said Mitchell Stephens, a journalism professor at New York University and author of "The Rise of the Image, the Fall of the Word." This change has pluses and minuses, he observed. People who try to build a private hideaway in the woods might come to realize that it isn't so private. But such images could also spot illegal logging in remote spots. "Now we can have a Godlike view, looking down from the heavens," he said. "I can understand why people would be nervous. But the cameras can make the world more transparent and open. I'm for that." E-mail: novelties(a)nytimes.com. _______________________________________________ tt mailing list tt(a)postbiota.org http://postbiota.org/mailman/listinfo/tt ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 2

Re: [Doctrinezero] A brief note on ZS ideas and the relationship with Marxism, Communism, & The Zeitgeist Movement
by Eugen Leitl 17 Aug '13

17 Aug '13

----- Forwarded message from Rüdiger Koch <rudiger.koch(a)gmail.com> ----- Date: Fri, 16 Aug 2013 21:38:29 +0200 From: Rüdiger Koch <rudiger.koch(a)gmail.com> To: doctrinezero(a)zerostate.is Subject: Re: [Doctrinezero] A brief note on ZS ideas and the relationship with Marxism, Communism, & The Zeitgeist Movement Reply-To: doctrinezero(a)zerostate.is Power comes from control over the monetary system. Remove that - walk away from the bank and their power gets diminished. That is why Austria stomped on the Wörgl experiment. That is why they go against Bitcoin and other alternatives with such a vengeance - it is by no means justified by the actual size of the currency. Money is their power and their Achilles' heel. Try to overthrow them - the Stasi knows about your plans before you know them - failure at a very early stage is inevitable. Violence is futile. But get them at the money - by walking away from it, and they will be as powerful as the ancient gods. How did they lose their power? People walked away from them. What can we do? We define our own money. Bitcoin is a start. Zero Reserve is a perfect complement. It closes the main vulnerability of Bitcoin - the centralizen exchanges. Zero Reserve has the potential to obsolete the banks. It can democratize money. It allows everyone, literally everyone, to act like a bank. Zero Reserve is real. It is a workable plan. We can do it without parliaments, lobbying or anything - by simply doing it. Will it create a perfect world? No. Miracles are for religion. This is it: https://github.com/zeroreserve/ZeroReserve/wiki You can keep talking about the perfect world. You can talk about redistributing money. I talk about *distributing the monetary system*. And I am not just talking - I am programming the means to it. Distributing the monetary system is one of the few good chances I see to avert the desaster of the coming crash. Much of the value that is produced is consumed by the monetary system. Make this system obsolete and everyone can be much richer than today. We need not fear the robotic revolution if access to the means of production is possible for everyone. But to permit that, first we have to obsolete the monetary system. -Anu _______________________________________________ Doctrinezero mailing list Doctrinezero(a)zerostate.is Unsubscribe: https://lists.zerostate.is/mailman/listinfo/doctrinezero ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [cryptography] LeastAuthority.com announces PRISM-proof storage service
by Eugen Leitl 17 Aug '13

17 Aug '13

----- Forwarded message from zooko <zooko(a)zooko.com> ----- Date: Fri, 16 Aug 2013 23:11:22 +0400 From: zooko <zooko(a)zooko.com> To: Nico Williams <nico(a)cryptonector.com> Cc: cryptography(a)randombit.net Subject: Re: [cryptography] LeastAuthority.com announces PRISM-proof storage service User-Agent: Mutt/1.5.21 (2010-09-15) On Tue, Aug 13, 2013 at 03:16:33PM -0500, Nico Williams wrote: > > Nothing really gets anyone past the enormous supply of zero-day vulns in their complete stacks. In the end I assume there's no technological PRISM workarounds. I agree that compromise of the client is relevant. My current belief is that nobody is doing this on a mass scale, pwning entire populations at once, and that if they do, we will find out about it. My goal with the S4 product is not primarily to help people who are being targeted by their enemies, but to increase the cost of indiscriminately surveilling entire populations. Now maybe it was a mistake to label it as "PRISM-Proof" in our press release and media interviews! I said that because to me "PRISM" means mass surveillance of innocents. Perhaps to other people it doesn't mean that. Oops! Regards, Zooko _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0