- cypherpunks - lists.cpunks.org

Re: ISIS has ‘help desk’ to aid would-be terrorists with encryption
by grarpamp 18 Nov '15

18 Nov '15

Lots of these circulating the tubes... https://www.reddit.com/r/nottheonion/comments/3t2g15/isis_has_help_desk_for… On Tue, Nov 17, 2015 at 8:19 PM, Henry Baker <hbaker1(a)pipeline.com> wrote: > Perhaps the U.S. govt -- e.g., OPM & Brennan -- should consider emulating these opsec help desks. > > Also, wouldn't an encryption 'help desk' have to be unencrypted/insecure *by definition* ? > > I mean, if these guys need so much help doing encryption, they'd never even be able to access an encrypted help desk in the first place. > > I don't know if Johnny can encrypt, but we keep hearing rumors that Muhammad can. > > --- > EXTREMIST FORUMS PROVIDE DIGITAL OPSEC TRAINING > > Aaron Brantly, Muhammad al-`Ubaydi May 28, 2015 > > https://www.ctc.usma.edu/posts/extremist-forums-provide-digital-opsec-train… > > https://www.ctc.usma.edu/v2/wp-content/uploads/2015/05/CTCSentinel-Vol8Issu… > > --- > > http://thehill.com/policy/cybersecurity/260402-isis-help-desk-aides-would-b… > > ISIS has ‘help desk’ to aid would-be terrorists with encryption > > By Cory Bennett - 11/17/15 10:48 AM EST > > The Islamic State in Iraq and Syria (ISIS) has set up a 24-hour “help desk” to advise burgeoning jihadists on encrypting their communications in order to evade authorities, NBC News reported. > > The tactic has developed rapidly over the last year, according to several U.S. Army counterterrorism analysts. Roughly half a dozen senior operatives are now always on hand at this center to provide digital pointers. > > This help desk demonstrates the terorrist group’s increasing savvy in using digital tools to both recruit new members and to plan attacks. > > ISIS has taken credit for the deadly terrorist attacks on Paris last week that killed over 120 people. European officials say those behind the attack may have used some type of encrypted communication in the planning process. > > “They’ve developed a series of different platforms in which they can train one another on digital security to avoid intelligence and law enforcement agencies for the explicit purpose of recruitment, propaganda and operational planning,” said Aaron F. Brantly, a counterterrorism analyst at the Combating Terrorism Center, an independent research organization at the U.S. Military Academy, in an interview with NBC News. > > The discovery of such tech capabilities will likely fuel the already contentious worldwide debate over encryption standards. > > U.S. intelligence officials and lawmakers have already used the Paris attacks to call for some type of guaranteed government access to encrypted communications data at companies such as Apple, Facebook and Google. > > But privacy and digital rights groups have said that such access would weaken encryption for everyone without significantly helping law enforcement monitor potential terrorists. Many have also noted that terrorist groups have long developed their own encryption tools that would not be touched by any government rules. > > The ISIS help desk monitors leading security software and encryption methods, directing recruits to the most clandestine option. > > While a large community helps run the operation, there are five or six core members with collegiate- or masters-level training in information technology that fuel the help desk, said Brantly, the lead author of a paper on the topic. > > “They answer questions from the technically mundane to the technically savvy to elevate the entire jihadi community to engage in global terror," Brantly said. "Clearly this enables them to communicate and engage in operations beyond what used to happen, and in a much more expeditious manner. They are now operating at the speed of cyberspace rather than the speed of person-to-person communications." > > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography

1 1

Glomar'ing for more Manganese Nodules ;)
by grarpamp 18 Nov '15

18 Nov '15

http://motherboard.vice.com/read/deep-sea-gold-rush November 17, 2015 Here in Papua New Guinea, one well-financed, first-mover company is about to pioneer deep sea mining. And that will mean dispatching a fleet of giant remote-operated robotic miners 5,000 feet below the surface to harvest the riches scattered across ocean floor. These mammoth underwater vehicles look like they’ve been hauled off the set of a sci-fi film—think Avatar meets The Abyss. And they'll be dredging up ... manganese nodules—metal-rich clumps—awaiting extraction in near-limitless supply.

1 0

Re: [Cryptography] Sadly predictable: Terrorism used as excuse to attack encryption
by grarpamp 17 Nov '15

17 Nov '15

On Tue, Nov 17, 2015 at 12:41 PM, Miroslav Kratochvil <exa.exa(a)gmail.com> wrote: > I agree with you that there should not be restrictions on encryption. > Still, the problem is elsewhere -- we simply should not encrypt _that_ > much. (also applies to your car analogy, btw). > > To explain: Common people with reasonable operating systems/browsers > are now using bulk encryption on every single HTTP request they make, > on every single disk block they have, making SPF handshake with each > person they IM, etc.. Observe that only a really tiny amount of the > data is actually confidental (login tokens, business data, ...). Think > about what bulk encryption means for the consumption of computing > power (RSA ain't free, I'd actually expect more than gigawatts). Think > about what it means for law-enforcement agencies -- they can't even > simply prove that given single user is _not_ a suspect to narrow their > search. No wonder that a politician who was assigned the task to keep > the society secure&thriving would actually hate any kind of > encryption. And that is a problem, because the simplest thing he can > do is a ban. > > I'd prefer something less drastic before the ban comes, like forcing > the user/software selectively choose (by some smart API or a correctly > designed UI) what to encrypt, leaving the rest (most) of data > "ecologic" and "law-enforcement friendly". > > -mk > > > PS. In no way I suggest simply "turning SSL off", but there could be a > way that just authenticates the data without doing encryption. Method > for easily marking the "secret bits" of the stream would be cool as > well. > > PS2. In no way I suggest surrendering all our information to orwellian > big brother, but well, think of the good cops. I'd wager that overall code and feature bloat is the far larger consumer of electricity, especially since crypto in hardware. Also note how if your personal electricity use has dropped but your bill same or went up, doesn't matter what you use, they tax you for what they want. PKI like RSA has always been more costly than stream like AES, so some auth and special marked stream overhead isn't likely to save anything, because it's bloat. Nothing says you can't log your own proof of innocence Exhibitionists like you could even ship the footage in your house daily to your good cops for their innocent entertainment. Why not task yourself to keep yourself secure and thriving. And have a good laugh about ISIS with the good cops should they mistakenly knock once in a while about your crypto.

2 1

Re: [Cryptography] Sadly predictable: Terrorism used as excuse to attack encryption
by grarpamp 17 Nov '15

17 Nov '15

On Tue, Nov 17, 2015 at 1:19 PM, Tony Arcieri <bascule(a)gmail.com> wrote: > media accounts were already posting pictures of the Eiffel Tower along with > "God bless you on your mission" 72 hours before the attack: > > http://www.dailymail.co.uk/news/article-3320732/ISIS-supporters-shared-imag… > > It would be rather ironic if ISIS committed an opsec failure that bad which > intelligence services weren't able to pick up on, and yet encryption is > blamed anyway. Years of news reports has shown they don't consider it opsec failure but modus operandi. Unfortunately, absent other specific actionable intel knowledge, even such generic warnings picked up can't be acted on. So this is rather moot, what are you going to do, lock down a country everytime someone holds their fist in the air and wishes or swears... please. Let's get back to real police work. And understand that freedom isn't free.

1 0

Re: [cryptography] Paris Attacks Blamed on Strong Cryptography and Edward Snowden
by grarpamp 17 Nov '15

17 Nov '15

On Tue, Nov 17, 2015 at 1:39 PM, Givon Zirkind <givonne(a)gmx.com> wrote: > imho, the crypto involved is not the issue. not having boots on the ground, > good intel, good spies who can walk and talk like the enemy, is the real > issue. Exactly. Governments have had at least 15 years to strap those boots, and certainly have some good ones. These days it's probably just as interesting as USA vs. USSR in that regard... plots, schemes, double and triple agents... the spy game. It's interesting what other perhaps complementary and/or parallel forms of intel and boots have sprung up. Though best examples are surely not seen, wrapped in closeness to government agencies or other allegiences, and these links cover only one small theatre among the list of things any agents, actors and mafioso have always had an interest in... yet one can begin to get the idea... just how deep does this sort of online game go... https://twitter.com/TorReaper/status/661266213000073218 http://www.ghostsec.org/ http://pastebin.com/search?q=isdratetp4donyfy https://cpunks.org/pipermail/cypherpunks/2015-November/010940.html > there was no crypto in the false i.d. papers used to gain entry. > there is no crypto in exploiting the humanitarian aid being given to syrian > refugees. these people operate in unconnected cells. how much > communication can there be; once an idea is hatched; a plan formed and; put > into motion--from a few secret meetings. esp. since they know enough to > have to maintain radio silence. Like volunteering for missionary, cash and a blessing at sendoff is still a very hard problem to crack. Unless you become confidant of both Padre and Church itself, or simply become them... Regardless, if any of this affects your area you should definitely have your talking points and counter solutions lined up, because the exposure and fields of play are growing and it's not going away. Welcome to the connected world.

2 1

Paris Attacks Blamed on Strong Cryptography and Edward Snowden
by Александр 17 Nov '15

17 Nov '15

1. https://www.schneier.com/blog/archives/2015/11/paris_attacks_b.html 2. https://theintercept.com/2015/11/15/exploiting-emotions-about-paris-to-blam… <<As Paris reels from terrorist attacks that have claimed at least 128 lives, fierce blame for the carnage is being directed toward American whistleblower Edward Snowden and the spread of strong encryption catalyzed by his actions. Now the Paris attacks are being used an excuse to demand back doors>> <<how can “officials” and their media stenographers persist in trying to convince people of such a blatant, easily disproven falsehood: namely, that Terrorists learned to hide their communications from Snowden’s revelations? They do it because of how many benefits there are from swindling people to believe this. To begin with, U.S officials are eager here to demonize far more than just Snowden They want to demonize encryption generally as well as any companies that offer it. Indeed, as these media accounts show, they’ve been trying for two decades to equate the use of encryption — anything that keeps them out of people’s private online communications — with aiding and abetting The Terrorists>> <<Above all, there’s the desperation to prevent people from asking how and why ISIS was able to spring up seemingly out of nowhere and be so powerful, able to blow up a Russian passenger plane, a market in Beirut, and the streets of Paris in a single week. That’s the one question Western officials are most desperate not to be asked, so directing people’s ire to Edward Snowden and strong encryption is beneficial in the extreme>> <<There’s the related question of how ISIS has become so well-armed and powerful. There are many causes, but a leading one is the role played by the U.S. and its “allies in the region” (i.e., Gulf tyrannies) in arming them>>

4 3

Re: UK To Ban Crypto In Devices, Email And More
by John Young 17 Nov '15

17 Nov '15

Excellent development if the bill is enacted. Should shatter the complacency of crypto advocates and foster other means and methods now getting short shrift due to the faith in crypto hyping and marketing -- and tons of excuses why crypto has not been as effective as foreordained, blame users, blame implementation, blame standards committees, blame spies, blame legislators, blame certificate authorities, blame hardware, blame insiders and outsiders, blame amateurs, blame backdoors, blame venal marketers who sold out to authorities, blame duat hatters working both sides of the porous divide, blame open and closed source, the pile of excuses grows exponentially as money is heaped onto the fire for burning through faster and faster. NSA has at least 191 colleges on the take for information assurance studies, with more joining daily to get while the getting is good, sending graduates to corporations, institutes, NGOs, hack world, leak world, defy authority world as evidenced here in this sacred site of tipped gravestones to cipher heroics. At 12:27 PM 11/3/2015, you wrote: >http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/11970391/Interne… > >Internet firms to be banned from offering unbreakable encryption >under new laws > >3:16PM GMT 02 Nov 2015 > >Internet and social media companies will be banned from putting >customer communications beyond their own reach under new laws to be >unveiled on Wednesday. >Companies such as Apple, Google and others will no longer be able to >offer encryption so advanced that even they cannot decipher it when >asked to, the Daily Telegraph can disclose. >Measures in the Investigatory Powers Bill will place in law a >requirement on tech firms and service providers to be able to provide >unencrypted communications to the police or spy agencies if requested >through a warrant.

15 55

Leaked Documents Confirm Polygraph Operators Can't Detect Countermeasures
by grarpamp 17 Nov '15

17 Nov '15

http://tech.slashdot.org/story/15/11/16/1616226/leaked-documents-confirm-po… George Maschke writes: AntiPolygraph.org has published a document (14 MB PDF) on polygraph countermeasures that is allegedly derived from classified information. The document suggests techniques that polygraph operators might use in an attempt to detect efforts to beat the polygraph, but fails to offer any coherent strategy for detecting sophisticated countermeasures such as those outlined in AntiPolygraph.org's The Lie Behind the Lie Detector (1 MB PDF) or Doug Williams' How to Sting the Polygraph. Ominously, the leaked document avers that an examinee's stated lack of belief in polygraphy is a marker of deception. AntiPolygraph.org has also published an older U.S. Air Force Office of Special Investigations polygraph countermeasure handbook (3.2 MB PDF) that similarly offers no methodology for detecting sophisticated countermeasures (such as any actual spy, saboteur, or terrorist might be expected to use).

1 0

Al-Hayat Media Group (Daesh/ISIL) on the DarkWebs
by grarpamp 17 Nov '15

17 Nov '15

http://isdratetp4donyfy.onion/ While not the first time darknets have been used for such things, expect an inrush of media queries over this one, and an influx of new sites. On the crypto side... an IM often purported to be used by them: https://telegram.org/ With battles between systems taking place entirely within the darknet, mixed with clearnet, and supposedly real world ops... for social cause, profit, and lols... https://twitter.com/opparisofficial https://twitter.com/hashtag/OpParis https://twitter.com/hashtag/OpISIS https://www.youtube.com/results?search_query=OpParis https://www.youtube.com/results?search_query=OpISIS http://reportonlineterrorism.com/ http://ghostsecuritygroup.com/ https://twitter.com/GhostSecGroup https://twitter.com/CtrlSec https://twitter.com/KatNarv Funding models for everyone... http://www.dw.com/en/bitcoin-islamic-states-online-currency-venture/a-18724…

1 0

Re: FOIA MuckRock API
by coderman 16 Nov '15

16 Nov '15

On 11/10/15, Michael Morisy <m(a)morisy.com> wrote: > I'm using 2.7.8. Mitch apparently made some improvements to the API, > so not sure if that made a difference, haven't had time to try it > lately. the best Mike: have you tried this again recently? i was able to sorta-repro if network was spotty and a large document failed during transfer, but otherwise this works solid for me. still catching up, including pending improvements to script behavior. more soon... best regards,

2 1