- cypherpunks - lists.cpunks.org

The Reading Room hidden service
by Crypto 02 Mar '15

02 Mar '15

Hello Everyone! About once a week I go in search of TOR hidden services that may be of interest to me. I found one this morning that I think is really great! I purchased a Ebook reader a couple of weeks ago and have been looking for sites to download books on the cheap (free). I found The Reading Room this morning at http://do2j6w3zf2esv4ko.onion/_catalog/ I don't usually promote ANY website but I think whoever did this site deserves a pat on the back (or a donation). I downloaded several Ebooks with no problems. Pardon my posting this if you are offended but I'm SO happy to find a website that will help feed my Ebook addiction! -- Crypto https://lastpass.com/f?3921926

6 9

[Bitcoin-development] New paper: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies
by Eugen Leitl 02 Mar '15

02 Mar '15

----- Forwarded message from Andrew Miller <amiller(a)cs.umd.edu> ----- Date: Mon, 2 Mar 2015 11:48:24 -0500 From: Andrew Miller <amiller(a)cs.umd.edu> To: Bitcoin-development(a)lists.sourceforge.net Subject: [Bitcoin-development] New paper: Research Perspectives and Challenges for Bitcoin and Cryptocurrencies Message-ID: <CAF7tpEyHyg7cB8DQiwb-gGg5v5Hn1Kurw2GaVtid=LyJrB1XQA(a)mail.gmail.com> We (Joseph Bonneau, myself Arvind Narayanan, Jeremy Clark, Ed Felten, Josh Kroll -- from Stanford, Maryland, Concordia, Princeton) have written a “systemization” paper about Bitcoin-related research. It’s going to appear in the Oakland security conference later this year (IEEE Security and Privacy) but we wanted to announce a draft to this community ahead of time. http://www.jbonneau.com/doc/BMCNKF15-IEEESP-bitcoin.pdf One of the main goals of our work is to build a bridge between the computer science research community and the cryptocurrency community. Many of the most interesting ideas and proposals for Bitcoin come from this mailing list and forums/wikis/irc channels, where many academic researchers simply don’t know to look! In fact, we started out by scraping all the interesting posts/articles we could find and trying to figure out how we could organize them. We hope our paper helps some of the best ideas and research questions from the Bitcoin community bubble up and inspires researchers to build on them. We didn’t limit our scope to Bitcoin, but we also decided not to provide a complete survey of altcoins and other next-generation cryptocurrency designs. Instead, we tried to explain all the dimensions along which these designs differ from Bitcoin. This effort has roughly been in progress over two years, though it stopped and restarted several times along the way. If anyone has comments or suggestions, we still have a week before the final version is due, and regardless we plan to continue updating our online version for the forseeable future. ------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development ----- End forwarded message -----

1 0

Internet privacy, funded by spooks: A brief history of the BBG
by John Young 01 Mar '15

01 Mar '15

Internet privacy, funded by spooks: A brief history of the BBG, March 1, 2015 http://pando.com/2015/03/01/internet-privacy-funded-by-spooks-a-brief-histo… Open Technology Foundation featured, along with Tor, Appelbaum, Doctorow, Kobeissi, Soghoian, et al

2 1

Re: Governments Covertly Fund Internet Freedom Activists
by shelley＠misanthropia.org 01 Mar '15

01 Mar '15

On March 1, 2015 10:51:09 AM brian carroll <electromagnetize(a)gmail.com> wrote: > perhaps the institutionalization of 'royal perks' explains > in part the necessity of a one-party governing system, > where any actual opposition (politics) are then managed > and absorbed into this model, to protect/secure/maintain > aristocratic lifestyles otherwise threatened by actual change, > where the focus of issues of subsidy then becomes the poor: > > "hark! peasants are drinking wine, wine!! with Our Money!" > > (in a top-down surveillance context, who benefits/profits most?) ^ This +100. Very prescient; I could not have put it any better.

1 0

Re: Dollar Value of a Datamined "Free" Service User?
by Snehan Kekre 27 Feb '15

27 Feb '15

-------- Original Message -------- Subject: cypherpunks Digest, Vol 20, Issue 36 Time (GMT): Feb 26 2015 17:05:36 From: cypherpunks-request(a)cpunks.org To: cypherpunks(a)cpunks.org When replying, please edit your Subject line so it is more specific than "Re: Contents of cypherpunks digest..." Today's Topics: 1. Re: Dollar Value of a Datamined "Free" Service User? (Ryan Carboni) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 Feb 2015 04:18:51 -0800 From: Ryan Carboni To: cpunks Subject: Re: Dollar Value of a Datamined "Free" Service User? Message-ID: Content-Type: text/plain; charset="utf-8" The marginal cost of providing an additional account to the average user is pretty cheap. It is my understanding that the business models of most "cloud" companies is to provide a little free service to get users accustomed to their UIs, so that they would purchase a business license or equivalent. Dropbox does not make it's money through data mining or advertising. Correct me if I'm wrong.

1 0

Democratic judiciaries and internet protocols both embed racial profiling
by Nicolas Bourbaki 26 Feb '15

26 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A packet sent by an American or European should be given no greater privileges then a packet sent by someone from the middle east. Those holding dual citizenry (one being of their locale and the other a product of the internet' stateless generation) will not find this question odd. But to end racial profiling in the protocol (example [1]) questioning the rationale of stateful civil liberties is also required. Initially this argument will seem a moral one but there are practical reasons to consider. The increasingly globalised society is doing little to stem the threat of terrorism while at the same time increasing the call for more equal rights. Together this warrants questioning the justification and benefits of discriminatory rights. ## Justification A primary tool for the arbitration of discriminatory surveillance policies are secret courts. One justification for secret courts is the protection of sources and methods. Any investigation into an on-going threat requires some form of secrecy. Terrorism is one such threat. But this is not the only on-going threat that courts handle. We should consider whether the vanilla judicial systems cannot already handle this requirement. Existing courts must also handle on-going threats and have to do so while considering how the utilisation of secrecy for greater security, and perhaps more efficient investigation, balances against the risk to social contracts that define liberties and rights. With each justification for protection of methods when investigation terrorism threats we can ask if these were any different for investigations into the racketeering ring of, say, Al Capone. Clearly such investigations would be more efficient when perpetrators can be swept off into secret prisons on the signature of a secret judge. Existing courts already provide some room for discretionary secrecy. The prosecution can determine which evidence they disclose to the courts or wider public. In many nations there is also room for disclosure only to the judge while avoiding exposure to the wider public record. Finally parallel construction [2] is a questionable but often used method for protecting both sources and methods. Further, some exposure of methods provides an early feedback to individuals that they can get caught. Whereas when the means to find criminals are unknown and the criminals themselves are whisked off into secrecy this benefit is completely lost. Another justification for secret courts may be risk of spys within the court itself. With intent to obtain influence or at least advanced warning of investigative activity. But are our judiciaries less equipped to handle this threat than when it comes from state sponsored intelligence agencies? If anything the threat is diminished because the architecture and premise of terrorist institutions is much more decentralised than state intelligence. Terrorist institutions are one partly of memetics. The violent form of "grumpy cat" [3]. Within societies threatened by their ideologies the appeal reaches only a few in like mind. Unlike your 3-letter-agency-of-choice they lack the appeal to mount sufficient infiltration of any local judiciary. Further, the centralisation of all terrorist based investigation in the form of a handful of secret courts may be one of the few reasons left consider the threat of infiltration. Whereas if public courts were used this threat would be diffused as is the case with investigations into other national or international on-going threats. Therefore... **The justification for nationalist or racial rights may be efficiency alone. But at what cost?** ## Benefits and Cost For most the foundational documents of their country of origin are held in almost religious regard. As in religion these documents are subject to interpretation even though the indoctrinated claim they are timelessly impervious to it. They are social contracts. The cost benefit analysis weighed tacitly by judges when permitting secrecy is a consideration of the social contract a given case may effect. They collectively change that contract through their actions. This subjectivity is both a risk and a necessity. I once asked a rabbi why kosher laws do not allow Jews to eat a chicken and cheese sandwich? What the Bible forbids is boiling a "kid" in its mothers milk. I've rarely enjoyed boiled sandwiches and never heard of chicken milk. The Rabbi explained something to the effect "God gave the law to man for the rabbinate to change and interpret. The kosher laws are as much about how behaviour is perceived as it is about what God commands. Someone on the other side of the room may just see you eating meat and cheese together. This would encourage the wrong understanding of that law." Interpretation is a slippery slope. Yet, at least Judaic law acknowledges the social contract and that perception is important. Where as our governments, through secrecy, negate even the possibility or interpretation or consideration of perception. With our collective identity and social threats becoming ever globalised the result of enforcing an absolute interpretation is ignorance of sovereignty (see drone warfare) and increasing rejection of equal rights. With these acts the state in turning from a conduit that fosters individuality into one that reinforces homogeneity. With the risk that the meme will increasingly hold more weight than the rationale. I have been lucky enough to have lived in countries that know how much they suck at war so the Americanism "War on ..." always seems strange. Yet the "War on Drugs" or "War on Poverty" are efforts that this society perceives as a collective will because of shared equality. If we want the War on Terror to be perceived as a collective issue globally we will need to start with endowing the "other" with equality. Those that frame this debate in the context "Liberty versus Security"... **It is easy to confuse Privilege for Liberty.** ## Racial Profiling I'm certain there is reason to question these arguments yet I believe they give some reason for debate. (i) The public judiciary already has many of the tools required to handle current threats. (ii) Centralization into secret courts creates its own vulnerability and its own justification. (iii) Necessity for efficiency ignores the cost to social contracts in a globalised context. (iv) Secrecy makes impossible consideration of equal rights in a global context and removes the possibility to account for perception. (v) Secrecy removes a feedback that informs civil behaviour in societies. Along with the judiciary there is a parallel of discriminatory profiling within the field of engineering. Our protocols have been built for such profiling. I do not feel alone in questioning whether the current stewards of the internet shouldn't be replaced with those of government agency from which the internet was born. Balkanisation is increasingly being seen as a solution, not the threat. Yet we protest while boringly waiting for some form of acknowledgement of responsibility from the IETF to change the protocols. In our digital world the concern for how protocols support and make discrimination possible will seem less distant. Rather than congratulate ourselves for dejecting a member of the NSA from the Crypto Forum Research Group we should be more disturbed by the inability of the IETF to acknowledge any responsibility for the ethics in the protocols. - -- 1. "GeoIP is a threat to democracy" https://cpunks.org/pipermail/cypherpunks/2014-July/005037.html 2. https://en.wikipedia.org/wiki/Parallel_construction 3. https://startpage.com/do/search?cat=pics&query=grumpy+cat -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJU75vTAAoJEHi6xtksL8/uwC8P/0PkrdsbZzo4qcosdVeNC9Ei sroo0ohyICt34uxeEpTisdWxv0GKPVFGqSDBAYfvRwc1+Ko6YnEeDlqb3+TNktTE GIzZAwslb3LJx09IERh6xMbdMkkXl2iw9qkRmvDK56Txk5B9HNY3bR/xBFN9oi4x mzOx8uN39xLxnUAff8071wkAzepZXVT6TC1gIq/95Vqrt8cP8C5oP+q04jHnxSev X+B18+3ytQvlbbRMVu3BPfDd8/PBdga6jdvnDIaVclM6Olagw1hwHv5IgXIA6edP 5UGc5v+uadYknVabDN/bQXqo9rYLAbwgAJgbaGPemdFLOl6mnsIaGiQCrKa/C2wm m1GX6D/kna3bUVHm6pZ+W0A7c9ERMLgDjItrCApUdXGgU2c770shxkQZVyWwUY5g G4fhpk9PgEeouZVRtHVjSw2cAhhsTNVaWWotJ3UPL9n6Soxtu68wNV/hQUhsEAHO NPCTV6LZVjaN11jZi+2JhLVe2w+4d6GNQjSkm1C1cs7XHqZ2P0Z4R6oigU8n6PIx aEZGvvhRct3PUodshOqQUwV1Ml4nUTEn6diJvDkHxW5YN2XHfJIv3zLo4tMQ6fF8 DV+uUSBl+arNKe/ehmxN+G550JVoQnOLUOcihNeCqFqWBCtlsWnP4vgRFFfl79iH EyI9rZP34J/yJMOJK/h/ =rYE3 -----END PGP SIGNATURE-----

1 0

Re: Dollar Value of a Datamined "Free" Service User?
by Ryan Carboni 26 Feb '15

26 Feb '15

The marginal cost of providing an additional account to the average user is pretty cheap. It is my understanding that the business models of most "cloud" companies is to provide a little free service to get users accustomed to their UIs, so that they would purchase a business license or equivalent. Dropbox does not make it's money through data mining or advertising. Correct me if I'm wrong.

2 1

Belarus just banned Tor and other censorship circumvention tools
by Anton Nesterov 25 Feb '15

25 Feb '15

"11. If government inspection find Internet resources or anonymity tools (proxy servers, anonymous networks like Tor, and so on), which can be used to get access for Internet resources with limited access, they should add identifier of that Internet resources or anonymity tools to the list of limited access." http://pravo.by/main.aspx?guid=12551&p0=T21503059&p1=1&p5=0 text (Russian) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

1 0

Re: [Cryptography] trojans in the firmware
by grarpamp 25 Feb '15

25 Feb '15

On Tue, Feb 24, 2015 at 8:53 PM, Jerry Leichter <leichter(a)lrw.com> wrote: > On Feb 24, 2015, at 2:24 AM, Ryan Carboni <ryacko(a)gmail.com> wrote: >> Fighting against a nation state using equipment you cannot design >> yourself or anyone you know could design... don't. > But in fact you can't design or manufacture *everything*. Do you > need control of your chips all the way back to mining the sand? Aren't there really only a couple ways to solve this? A) Somewhat similar to the IAEA, everyone pick their own trusted and knowledgeable people, then assemble everyone's people together with orders: 1) Respect whatever soverign secrets you see [profits, design advantages, etc] 2) Just tell us what we want to know [do the chips that come out of the fab equal the designs that went into it, and are those designs free of trust issues] This is complicated by needing to insert yourself into those legacy areas, as well as verify essentially that of B below. B) Contact your favorite billionaires and pitch the case for a truly open fab. And yes, that could include starting from ... > Do you need control of your chips all the way back to mining the > sand? [...] build a computer out of [...] simple logic gates > JK-flipflops Since that tech is already discovered, it would just be an open rapid physical rebuild of history from transistor to today. Maybe that would take 10 years of dedicated work to create a trusted fab that matches todays tech and can replicate itself. And if you think about it, it could be a profitable venture because if you did it right, you'd be able to openly and certifiably create trusted Orange Book / CC style hardware... something governments, large entities and even users have always wanted but haven't been able to obtain in affordable quantites and purposes. This may be easier because there's no legacy to remediate. And there's no reason you couldn't manufacture private chips too, the only restriction being that terms that would compromise the fab are not allowed. https://en.wikipedia.org/wiki/International_Atomic_Energy_Agency https://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.wikipedia.org/wiki/Trusted_computing_base http://cm.bell-labs.com/who/ken/trust.html https://en.wikipedia.org/wiki/Backdoor_(computing) https://en.wikipedia.org/wiki/Open-source_hardware

1 0

Re: [Cryptography] trojans in the firmware
by grarpamp 25 Feb '15

25 Feb '15

On Tue, Feb 24, 2015 at 10:48 AM, Kay Rydyger <kay.rydyger(a)yahoo.co.uk> wrote: > > The question was [... firmware spies] > The answer is [...] to encrypt data. No, reading bits from platters or the bus is a partial analysis of the whole firmware question. It's already been suggested in links how firmware can hook the users unencrypted boot binaries through to the users kernel. For that matter, a modified boot chain could be stored in the service area. A user would have to use SecureBoot, TPM, IOMMU, TXT, GELI and perhaps other things, all of them properly, having no holes, together, right now, at least three of which they are unlikely to have ubiquitous access to until a couple hardware generations or personal refresh cycles into the future. An ideal full solution for which is yet to come. Not to mention needing to install it all cleanly (from BTW, an install image which has no reproducible build and no cryptographic chain back to the insecure unsigned source repo anyways). But yeah, let's talk circular instead of about possible actually coding defense in depth such as maybe blocking the most common easiest path a malicious opcode will likely take to irrepairably infect clean hardware in the first place... through the drivers ... > There is no threat to freebsd ... because at least Unix is said to be immune to threat... http://www.freebsd.org/security/advisories.html http://www.openbsd.org/errata56.html http://web.nvd.nist.gov/view/vuln/search-results?query=linux+kernel&search_… > Weaknesses of this measure are remote and highly costly for the > attacker. If one is such a person of interest It's already been talked how this tech will be integrated into everyday run of the mill malware. And how users will be subject to infected drives via second purchase, inheritance (both from other people and from other operating systems), use of hosting services, trading, booting CD's, etc. Persistant malware in users boot chains is nasty, users don't have to be of interest or be targeted, the code doesn't care, grandma's surfbox could get it. Please learn to email... trim the original to the minimum needed for context, reply inline below, and stop copying 400 line digests with meaningless digest subject lines out to everyone on the list. On whenever, someone else wrote: > Since the chip holding the firmware has > leads through which it is loaded with the firmware, > is it not possible to disable or burn (with laser) or cut > just the leads through which the chip is WRITTEN to > (in order to re-program it)? Depends on the design. The hacking links or docs from the drive/chip vendors would be more helpful there.

1 0