- cypherpunks - lists.cpunks.org

Hardware tokens and crypto hardware in wild general
by Tomas Overdrive Petru 18 Nov '15

18 Nov '15

Dear mailing-list, today is day of many questions but that should be ok since from question knowledge can possibly grow. So my question is if you are aware of this project: https://www.yubico.com/products/yubikey-hardware/ or some of its competitors. What is your experience and so. This potential thread is based on Twitter question under hashtag #cryptography if somebody do know some useful crypto hardware project. Here is one. Hope more will follow. Regards, - Over -- “Borders I have never seen one. But I have heard they exist in the minds of some people.” ― Thor Heyerdahl Telegram...................@over23 facebook chat..............overdrive23(a)chat.facebook.com facebook...................facebook.com/overdrive23 projects...................https://brmlab.cz/user/overdrive twitter....................https://twitter.com/#!/over2393 last.fm....................http://www.last.fm/user/overdrive23 GnuPG key FingerPrint......08EA E4DC EF85 0F02 9267 5B48 2E58 6902 C5F8 794C Public key ................http://overdrive.dronezone.eu/overdrive.txt

1 0

Re: [Cryptography] ISIS has ‘help desk’ to aid would-be terrorists with encryption
by grarpamp 18 Nov '15

18 Nov '15

On Wed, Nov 18, 2015 at 10:02 AM, I.G. Mant <ingusmant(a)gmail.com> wrote: > here comes the terrorists to say they have a helpdesk > nonetheless to help all the baddies commit their crimes There's no doubt these particular criminals help each other both digitally and in physical world. Criminal forums off in the corners of the internet are as old as the internet itself. And by definition they must be easy to find / access by potential users, otherwise they would have no use. If the news reports are correct (and they claim some quite specific details) then just as with the onion link to Al-Hayat, there must be a publicly known link to said helpdesk. So... big question... where is the link? http://www.nbcnews.com/storyline/paris-terror-attacks/isis-has-help-desk-te…

1 0

Whenever Shit Hits The Fan, Remember The Mission...
by grarpamp 17 Nov '15

17 Nov '15

https://www.youtube.com/watch?v=EuQLMXyGQOE https://www.youtube.com/watch?v=jRXsWtfQ2cA "I have a certain level of respect for hackers." https://www.youtube.com/watch?v=w_a7_pygtNA "Hey there NSA, how are you today?" https://www.youtube.com/watch?v=1w6GtwOvnWM "IRC, darknets, down now?... I'll use pigeons and smoke signals..." https://www.youtube.com/watch?v=Rkk2d3O64ns "Global universal internet is the only tool we still have between our hands to address these global issues... a fight we have to fight..." Whatever may be your mission... Vive La France! Vive Le Punk :-) [Thread is short video link thread, post away.]

1 0

Re: ISIS has ‘help desk’ to aid would-be terrorists with encryption
by grarpamp 17 Nov '15

17 Nov '15

Lots of these circulating the tubes... https://www.reddit.com/r/nottheonion/comments/3t2g15/isis_has_help_desk_for… On Tue, Nov 17, 2015 at 8:19 PM, Henry Baker <hbaker1(a)pipeline.com> wrote: > Perhaps the U.S. govt -- e.g., OPM & Brennan -- should consider emulating these opsec help desks. > > Also, wouldn't an encryption 'help desk' have to be unencrypted/insecure *by definition* ? > > I mean, if these guys need so much help doing encryption, they'd never even be able to access an encrypted help desk in the first place. > > I don't know if Johnny can encrypt, but we keep hearing rumors that Muhammad can. > > --- > EXTREMIST FORUMS PROVIDE DIGITAL OPSEC TRAINING > > Aaron Brantly, Muhammad al-`Ubaydi May 28, 2015 > > https://www.ctc.usma.edu/posts/extremist-forums-provide-digital-opsec-train… > > https://www.ctc.usma.edu/v2/wp-content/uploads/2015/05/CTCSentinel-Vol8Issu… > > --- > > http://thehill.com/policy/cybersecurity/260402-isis-help-desk-aides-would-b… > > ISIS has ‘help desk’ to aid would-be terrorists with encryption > > By Cory Bennett - 11/17/15 10:48 AM EST > > The Islamic State in Iraq and Syria (ISIS) has set up a 24-hour “help desk” to advise burgeoning jihadists on encrypting their communications in order to evade authorities, NBC News reported. > > The tactic has developed rapidly over the last year, according to several U.S. Army counterterrorism analysts. Roughly half a dozen senior operatives are now always on hand at this center to provide digital pointers. > > This help desk demonstrates the terorrist group’s increasing savvy in using digital tools to both recruit new members and to plan attacks. > > ISIS has taken credit for the deadly terrorist attacks on Paris last week that killed over 120 people. European officials say those behind the attack may have used some type of encrypted communication in the planning process. > > “They’ve developed a series of different platforms in which they can train one another on digital security to avoid intelligence and law enforcement agencies for the explicit purpose of recruitment, propaganda and operational planning,” said Aaron F. Brantly, a counterterrorism analyst at the Combating Terrorism Center, an independent research organization at the U.S. Military Academy, in an interview with NBC News. > > The discovery of such tech capabilities will likely fuel the already contentious worldwide debate over encryption standards. > > U.S. intelligence officials and lawmakers have already used the Paris attacks to call for some type of guaranteed government access to encrypted communications data at companies such as Apple, Facebook and Google. > > But privacy and digital rights groups have said that such access would weaken encryption for everyone without significantly helping law enforcement monitor potential terrorists. Many have also noted that terrorist groups have long developed their own encryption tools that would not be touched by any government rules. > > The ISIS help desk monitors leading security software and encryption methods, directing recruits to the most clandestine option. > > While a large community helps run the operation, there are five or six core members with collegiate- or masters-level training in information technology that fuel the help desk, said Brantly, the lead author of a paper on the topic. > > “They answer questions from the technically mundane to the technically savvy to elevate the entire jihadi community to engage in global terror," Brantly said. "Clearly this enables them to communicate and engage in operations beyond what used to happen, and in a much more expeditious manner. They are now operating at the speed of cyberspace rather than the speed of person-to-person communications." > > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography

1 1

Glomar'ing for more Manganese Nodules ;)
by grarpamp 17 Nov '15

17 Nov '15

http://motherboard.vice.com/read/deep-sea-gold-rush November 17, 2015 Here in Papua New Guinea, one well-financed, first-mover company is about to pioneer deep sea mining. And that will mean dispatching a fleet of giant remote-operated robotic miners 5,000 feet below the surface to harvest the riches scattered across ocean floor. These mammoth underwater vehicles look like they’ve been hauled off the set of a sci-fi film—think Avatar meets The Abyss. And they'll be dredging up ... manganese nodules—metal-rich clumps—awaiting extraction in near-limitless supply.

1 0

Re: [Cryptography] Sadly predictable: Terrorism used as excuse to attack encryption
by grarpamp 17 Nov '15

17 Nov '15

On Tue, Nov 17, 2015 at 12:41 PM, Miroslav Kratochvil <exa.exa(a)gmail.com> wrote: > I agree with you that there should not be restrictions on encryption. > Still, the problem is elsewhere -- we simply should not encrypt _that_ > much. (also applies to your car analogy, btw). > > To explain: Common people with reasonable operating systems/browsers > are now using bulk encryption on every single HTTP request they make, > on every single disk block they have, making SPF handshake with each > person they IM, etc.. Observe that only a really tiny amount of the > data is actually confidental (login tokens, business data, ...). Think > about what bulk encryption means for the consumption of computing > power (RSA ain't free, I'd actually expect more than gigawatts). Think > about what it means for law-enforcement agencies -- they can't even > simply prove that given single user is _not_ a suspect to narrow their > search. No wonder that a politician who was assigned the task to keep > the society secure&thriving would actually hate any kind of > encryption. And that is a problem, because the simplest thing he can > do is a ban. > > I'd prefer something less drastic before the ban comes, like forcing > the user/software selectively choose (by some smart API or a correctly > designed UI) what to encrypt, leaving the rest (most) of data > "ecologic" and "law-enforcement friendly". > > -mk > > > PS. In no way I suggest simply "turning SSL off", but there could be a > way that just authenticates the data without doing encryption. Method > for easily marking the "secret bits" of the stream would be cool as > well. > > PS2. In no way I suggest surrendering all our information to orwellian > big brother, but well, think of the good cops. I'd wager that overall code and feature bloat is the far larger consumer of electricity, especially since crypto in hardware. Also note how if your personal electricity use has dropped but your bill same or went up, doesn't matter what you use, they tax you for what they want. PKI like RSA has always been more costly than stream like AES, so some auth and special marked stream overhead isn't likely to save anything, because it's bloat. Nothing says you can't log your own proof of innocence Exhibitionists like you could even ship the footage in your house daily to your good cops for their innocent entertainment. Why not task yourself to keep yourself secure and thriving. And have a good laugh about ISIS with the good cops should they mistakenly knock once in a while about your crypto.

2 1

Re: [Cryptography] Sadly predictable: Terrorism used as excuse to attack encryption
by grarpamp 17 Nov '15

17 Nov '15

On Tue, Nov 17, 2015 at 1:19 PM, Tony Arcieri <bascule(a)gmail.com> wrote: > media accounts were already posting pictures of the Eiffel Tower along with > "God bless you on your mission" 72 hours before the attack: > > http://www.dailymail.co.uk/news/article-3320732/ISIS-supporters-shared-imag… > > It would be rather ironic if ISIS committed an opsec failure that bad which > intelligence services weren't able to pick up on, and yet encryption is > blamed anyway. Years of news reports has shown they don't consider it opsec failure but modus operandi. Unfortunately, absent other specific actionable intel knowledge, even such generic warnings picked up can't be acted on. So this is rather moot, what are you going to do, lock down a country everytime someone holds their fist in the air and wishes or swears... please. Let's get back to real police work. And understand that freedom isn't free.

1 0

Re: [cryptography] Paris Attacks Blamed on Strong Cryptography and Edward Snowden
by grarpamp 17 Nov '15

17 Nov '15

On Tue, Nov 17, 2015 at 1:39 PM, Givon Zirkind <givonne(a)gmx.com> wrote: > imho, the crypto involved is not the issue. not having boots on the ground, > good intel, good spies who can walk and talk like the enemy, is the real > issue. Exactly. Governments have had at least 15 years to strap those boots, and certainly have some good ones. These days it's probably just as interesting as USA vs. USSR in that regard... plots, schemes, double and triple agents... the spy game. It's interesting what other perhaps complementary and/or parallel forms of intel and boots have sprung up. Though best examples are surely not seen, wrapped in closeness to government agencies or other allegiences, and these links cover only one small theatre among the list of things any agents, actors and mafioso have always had an interest in... yet one can begin to get the idea... just how deep does this sort of online game go... https://twitter.com/TorReaper/status/661266213000073218 http://www.ghostsec.org/ http://pastebin.com/search?q=isdratetp4donyfy https://cpunks.org/pipermail/cypherpunks/2015-November/010940.html > there was no crypto in the false i.d. papers used to gain entry. > there is no crypto in exploiting the humanitarian aid being given to syrian > refugees. these people operate in unconnected cells. how much > communication can there be; once an idea is hatched; a plan formed and; put > into motion--from a few secret meetings. esp. since they know enough to > have to maintain radio silence. Like volunteering for missionary, cash and a blessing at sendoff is still a very hard problem to crack. Unless you become confidant of both Padre and Church itself, or simply become them... Regardless, if any of this affects your area you should definitely have your talking points and counter solutions lined up, because the exposure and fields of play are growing and it's not going away. Welcome to the connected world.

2 1

Paris Attacks Blamed on Strong Cryptography and Edward Snowden
by Александр 17 Nov '15

17 Nov '15

1. https://www.schneier.com/blog/archives/2015/11/paris_attacks_b.html 2. https://theintercept.com/2015/11/15/exploiting-emotions-about-paris-to-blam… <<As Paris reels from terrorist attacks that have claimed at least 128 lives, fierce blame for the carnage is being directed toward American whistleblower Edward Snowden and the spread of strong encryption catalyzed by his actions. Now the Paris attacks are being used an excuse to demand back doors>> <<how can “officials” and their media stenographers persist in trying to convince people of such a blatant, easily disproven falsehood: namely, that Terrorists learned to hide their communications from Snowden’s revelations? They do it because of how many benefits there are from swindling people to believe this. To begin with, U.S officials are eager here to demonize far more than just Snowden They want to demonize encryption generally as well as any companies that offer it. Indeed, as these media accounts show, they’ve been trying for two decades to equate the use of encryption — anything that keeps them out of people’s private online communications — with aiding and abetting The Terrorists>> <<Above all, there’s the desperation to prevent people from asking how and why ISIS was able to spring up seemingly out of nowhere and be so powerful, able to blow up a Russian passenger plane, a market in Beirut, and the streets of Paris in a single week. That’s the one question Western officials are most desperate not to be asked, so directing people’s ire to Edward Snowden and strong encryption is beneficial in the extreme>> <<There’s the related question of how ISIS has become so well-armed and powerful. There are many causes, but a leading one is the role played by the U.S. and its “allies in the region” (i.e., Gulf tyrannies) in arming them>>

4 3

Re: UK To Ban Crypto In Devices, Email And More
by John Young 16 Nov '15

16 Nov '15

Excellent development if the bill is enacted. Should shatter the complacency of crypto advocates and foster other means and methods now getting short shrift due to the faith in crypto hyping and marketing -- and tons of excuses why crypto has not been as effective as foreordained, blame users, blame implementation, blame standards committees, blame spies, blame legislators, blame certificate authorities, blame hardware, blame insiders and outsiders, blame amateurs, blame backdoors, blame venal marketers who sold out to authorities, blame duat hatters working both sides of the porous divide, blame open and closed source, the pile of excuses grows exponentially as money is heaped onto the fire for burning through faster and faster. NSA has at least 191 colleges on the take for information assurance studies, with more joining daily to get while the getting is good, sending graduates to corporations, institutes, NGOs, hack world, leak world, defy authority world as evidenced here in this sacred site of tipped gravestones to cipher heroics. At 12:27 PM 11/3/2015, you wrote: >http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/11970391/Interne… > >Internet firms to be banned from offering unbreakable encryption >under new laws > >3:16PM GMT 02 Nov 2015 > >Internet and social media companies will be banned from putting >customer communications beyond their own reach under new laws to be >unveiled on Wednesday. >Companies such as Apple, Google and others will no longer be able to >offer encryption so advanced that even they cannot decipher it when >asked to, the Daily Telegraph can disclose. >Measures in the Investigatory Powers Bill will place in law a >requirement on tech firms and service providers to be able to provide >unencrypted communications to the police or spy agencies if requested >through a warrant.

15 55