- cypherpunks - lists.cpunks.org

Security/Privacy Tradeoff - Dave DeWalt of Mandiant
by Travis Biehn 14 Feb '15

14 Feb '15

>From the article http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca… "Dave DeWalt, CEO of security firm Mandiant, a participant in Friday's summit, hopes that fear of privacy invasion won't get in the way of the work that needs to get done. He pointed to the way the way public backlash to government surveillance programs revealed by former NSA contractor Edward Snowden stymied previous efforts to effectively open the lines of communication. "This balance between privacy and security ebbs and flows and unfortunately that was a huge setback -- a setback to the tune of several years," he said. " This is the first that I've ever heard of a tradeoff between privacy and security in the context of 'cyber security'. It's interesting to see this common trope for justifying widespread erosion of privacy in meatspace applied to 'cyber', where it is even more egregiously wrong. Travis

2 1

Russians--including BU CompSci Professor--Propose Limiting Access to Tor & Anonymizers
by Andrew 14 Feb '15

14 Feb '15

http://inform-24.com/4114-leonid-levin-zasluzhivaet-vnimaniya-vopros-o-dosu… Summary: Leonid Levin, notable professor at Boston University, who themselves run a heavily-trafficked Tor exit node, attacks Tor and supports state control of information. English translation: > Leonid Levin: "we should pay attention" to the question about pre-trial[?] blocking of anonymizers and ways to access anonymizing networks such as Tor. > > The committee chair of the State Duma (parliament) on Information Policy, Information Technologies and Communications, Leonid Levin, suggested to consider the question about limiting access to the Tor anonymizer internet-network. He said it during "Infoforum2015". > > By his words, this restriction would allow not only limiting access via anonymizing networks to information forbidden for distribution, but also would "extend the potential" for counteraction to the distribution of malicious programs. Besides, that would prevent illegal access to [hacking of?] computer information. > > At the same time Levin believes that the system of information control in the country "leaves much to be desired". He explains that "International tension, technologization and internalization of delinquency[?] make us put serious additional funds into military forces and law enforcement agencies. This is completely logical and justified, but for some reason the system of information control is [not in this series/not like this] yet." > > Levin mentioned that while Roscomnadzor (Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications) is successfully solving problems within its powers/limits, "it is obvious that it lacks people (staff units) and resources". ---------- https://vk.com/liga?w=wall-26121341_9052 Summary: Denis Davydov, Executive Director of the "League of Safe Internet" attacks Tor and its use in leading 'political struggle' English translation: > #anonymizers #tor #leagueOfSafeInternet > > In continuation of the theme of anonymizers > > League of Safe Internet: "Anonymous networks are used primarily to commit crimes" > > "We strongly support the idea of limiting Russia's access to anonymous networks, including Tor. "Invisible" Internet has made it possible for criminals of all stripes to hide their intentions from the state and use it to commit crimes: to acquire drugs and weapons, to distribute child pornography, to trade in human beings, including sex slaves, and to lead a political struggle. Do not forget that Tor is an American development and is used as well by the US intelligence agencies to expand the hegemony of the United States all around the world: agents and collaborators of the US State Department are engaged in illegal activities against countries while remaining anonymous to the authorities of that country. > > This is a very serious problem and it is bad that our government distanced itself from it and does not deal with it. > > I am convinced that the restriction on the use of anonymous networks will have a positive impact on us in every sense, will increase the trust of users to the network [Internet], and people will use it more actively and openly. This will lead to a specific economic effect and benefit to the state,"- the Executive Director of the League of Safe Internet Denis Davydov.

1 1

lab-in-a-box
by brian carroll 13 Feb '15

13 Feb '15

(quantifying and real-time activity auditing in-office) Lab-in-a-box takes aim at doctors' computer activity They call it "the Lab-in-a-Box." According to Nadir Weibel, a research scientist in the Computer Science and Engineering (CSE) department at the University of California, San Diego, inside the box are assorted sensors and software designed to monitor a doctor's office, particularly during consultations with patients. The goal is to analyze the physician's behavior and better understand the dynamics of the interactions of the doctor with the electronic medical records and the patients in front of them. The eventual goal is to provide useful input on how to run the medical practice more efficiently. Read more at: http://phys.org/news/2015-02-lab-in-a-box-aim-doctors.html

2 1

Fwd: Learning from dpr mistakes
by Travis Biehn 11 Feb '15

11 Feb '15

+ cypherpunks http://en.wikipedia.org/wiki/TRESOR - Keys are stored in debug or SSE registers and never leave the CPU. Use of AES-NI gives you solid performance. [side-channel DPA/timing etc vulnerable, though :(] That + trusted boot + dm-verity & FDE. Delicious. [Add Xen bare-metal & qubes-esque setup.] I've never seen TRESOR work, that might be a fun side-project for someone. -Travis On Tue, Feb 10, 2015 at 11:00 PM, grarpamp <grarpamp(a)gmail.com> wrote: > > But yeah, monitoring the environment is a solid idea, as is CPU <-> RAM > > encrypted pipeline. > > Someone was talking about this before, maybe in context of VM's. > Yet it really only works if after cold boot the key held in core for those > address segments luckily happens to be among the nonrecoverable > bits of ram. Who has researched those odds? Though defense in depth > is always good. > > Another way is to introduce a simple XOR hardware mask between > the cpu and ram, keyed via some external token, wrist fob, etc. > Unlikely computer makers respond to little demand for that. And > like AMT you certainly don't want it in your "Intel" chipset. > > Today you might be able to patch a kernel to switch over post bootloader > and consider its address space to now be that provided by an external > block device (sata/usb), which could then be such an encrypted mini > pluggable in the open hardware spirit of the usb RNG devices. It is the > ram, so you don't need a long term key there, random generated per boot > use is fine. Then you have moved keying issues to a smaller, manageable, > quickly blackenable device, like crushing its silicon with a thumbpress. > > >> 1) program to notice his magic bracelet is not near > >> 2) program to notice that vid cam is not a head but a chaotic scene > > Oh noes, my user's fitbit indicates ballistic heartrate / excess > g forces... blacken keys!... :-) > > Support more drunken ideas, btc: 1k2VQNW47wJDmsLCd2xkSjY28twKRah63 > -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn> -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

2 2

Fwd: [guardian-dev] Piñata server intrusion bounty
by grarpamp 11 Feb '15

11 Feb '15

---------- Forwarded message ---------- From: Patrick Connolly <patrick.c.connolly(a)gmail.com> Date: Tue, Feb 10, 2015 at 1:38 PM Subject: [guardian-dev] Piñata server intrusion bounty To: Guardian Dev <guardian-dev(a)lists.mayfirst.org> https://news.ycombinator.com/item?id=9027743 Would this be an interesting thing to put on a duplicate (...or production?) system and publicize? Might be an interesting practise for creating a form of canary, especially for projects that perhaps can't afford full and constant audits. Patrick -------------------------------------------- Q: Why is this email [hopefully] five sentences or less? | A: http://five.sentenc.es NOTE that my incoming emails are delayed from arriving in my inbox until 9am daily. If you need to reach me sooner, please use other means of getting in touch. #slowwebmovement _______________________________________________ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To unsubscribe, email: guardian-dev-unsubscribe(a)lists.mayfirst.org

3 3

Why Should[n't] I Work for the NSA?
by grarpamp 11 Feb '15

11 Feb '15

Have there been any threads or good public/panel debates involving one/both sides of this topic? https://www.youtube.com/results?search_query=working+for+the+nsa https://www.youtube.com/results?search_query=working+for+the+nsa+surveillan… https://www.youtube.com/watch?v=UrOZllbNarw

2 1

Re: time & crypto
by brian carroll 11 Feb '15

11 Feb '15

previous post wondered about what atomic clocks everywhere might be useful for, in particular crypto. the following article has more information on how mapping gravity via time differences via highest-precision timekeeping relates to unlocking mysteries of the earth's interior... (thus geological, geophysical) [0] one aspect that has me puzzled about timing is the claim by Apple that the Apple Watch is "One of the most accurate watches ever" while also noting its accuracy is 50 microseconds, and likely has its timing signal indirectly routed through the iPhone thus delayed prior to setting the internal clock. interesting article on this issue [1], with a backgrounder on existing timing technologies available today. in particular, information about Apple's time servers that are linked to UTC at nanosecond accuracy, and also that the clocks or timing circuits inside smartphones and tablets are _not as accurate as i imagined, also losing seconds a day (in this way somewhat like a mechanical watch for precision). the thing about the Apple Watch claim of timing accuracy, which the article makes clear, is that a GPS watch that gets its signal from orbiting satellites (via whatever speed-of-light & atmospheric signaling delay) is receiving a time signal that is accurate in the realm of nanoseconds from the universal standard, via several synchronized atomic clocks onboard the GPS satellites. so apparently that accurate timing signal has to transverse space and time to get to another distant location, and it is unknown if at its destination it has this accuracy or only when the signal is sent. the latter may be possible with additional calculations based on various parameters of GPS, thus the stated 50ns accuracy could be presumed that of a GPS watch if not iPhone GPS time signal. and yet with the tethering of the Apple Watch to the iPhone to maintain its timekeeping, somehow this 50 nanosecond accuracy drops to 50 microseconds, which the observer noted is "a million times worse than...the accuracy delivered by GPS." [1] because of this it is puzzling how the claim of ~extreme accuracy can be made by Apple when an iPhone has presumably better timing resolution due to design decisions, than a device categorized as a watch as if in the same lineage as precision chronometers that defined engineering excellence and feats of microengineering, which also /appear/ as watchfaces on the system-on-a-chip device, and yet that same adherence to accuracy is seemingly not occurring even while still being claimed. to give a sense of the issue, via proportion, a short video of Grace Hopper provides a way of considering this situation by measuring the maximum distance electricity travels in space in a nanosecond and microsecond. [2] this then allows hypothetical comparison between a GPS timing signal sent directly to a smartwatch (50ns*11.8inches = 49.1667 feet) to that GSP or other time signal relayed to the Apple Watch via tethered iPhone and its circuitry (50ms*984feet = 49,200 feet). in other words, length corresponds with accuracy to a universal time standard and a GPS watch is potentially '49 feet accurate' while the tethered Apple Watch seems to be '49,200 feet accurate' and saying this is precise in a horological context of timekeeping and precision timepieces. it just seemed so backwards to me because if there was onboard GPS on the Apple Watch then it would have precision that other devices also have, and the claim of precision would be self-evident, instead of potentially being marketing-speak to sell computer-devices via the pretext of its being a watch, etc. so a boundary or threshold appears to have been crossed or priorities may be different than expected in this way. an onboard radio antenna would also provide higher resolution, though perhaps the timing chip inside the SoC watch is not built around highest precision as may otherwise be assumed. hopefully in the future it will be. the issue that seems relevant in the lag or delay is that there is that much more room for things to happen in terms of unaccounted for delays outside the parameters of hours:minutes:seconds, if milliseconds is some threshold, and then events are occurring in a realm of microseconds or even potentially nanoseconds, and how crypto could be operating or calculating in those dimensions and dynamics otherwise unseen or unobservable, such as 2+2=4 if looked at one way, and 2+2=5 if viewed outside those boundaries. [3] note: i specifically wrote about the above issue as part of a larger Apple Watch analysis, [4] and these recent articles provided more to consider about what may be involved. [4] -- 0. Cryogenic clocks pave the way to new measurements http://phys.org/news/2015-02-centimeter-cryogenic-clocks-pave.html [quote] According to Katori, "It was a great feeling to have shown this excellent agreement between the clocks. If we can miniaturize this technology further, it would have useful applications, since tiny fluctuations in gravitational potential could be used to detect underground resources, underground spaces, and the movement of lava. We also hope that in the future, this will accelerate the movement toward a new definition of the international second, based on optical lattice clocks, to an even more stringent standard than the current definition of the second, which is based on cesium oscillation." [/unquote] 1. How Apple Watch achieves its timekeeping accuracy http://watch.camp/2014/11/apple-watch-timekeeping-accuracy/ 2. Grace Hopper - Nanoseconds / Microseconds https://www.youtube.com/watch?v=JEpsKnWZrJ8 3. [2].5 + [2].5 = [5] 4. AWO: critique of Apple Watch concept… https://appleobservations.wordpress.com/index/5-2/

1 0

Fw: The Reading Room hidden service
by Juan 11 Feb '15

11 Feb '15

Begin forwarded message: Date: Tue, 10 Feb 2015 13:40:00 -0600 (CST) From: "Crypto" <crypto(a)jpunix.net> To: "juan.g71" <juan.g71(a)gmail.com> Subject: Re: The Reading Room hidden service On Tue, 10 Feb 2015 15:49:59 -0300, Juan <juan.g71(a)gmail.com> wrote: > > > Oh, I forgot to mention http://gallica.bnf.fr/ Do you know what "stealing a thread" is? It means taking a message thread that someone else started and using it to promote your own agenda. Crypto https://www.digitalocean.com/?refcode=b90b690ca5bb --------end of forwarded message------------ this list has some funny people in it...funny as in self-parody.

1 0

Learning from dpr mistakes
by David Honig 11 Feb '15

11 Feb '15

A number of public reviews of DPR's infosec mistakes have been published. I think a strong solution to the 'tackled in library' defects would be to have: 1) program to notice his magic bracelet is not near 2) program to notice that vid cam is not a head but a chaotic scene #2 is particularly easy without extra hardware (ca. 2015) You'll have to switch it off when you visit the loo. And of course, things like 'back to wall facing forward' would have been helpful. Claustophilia is a useful trait. I wish to God these calculations could be done by a steam engine," Babbage complained

3 2

Re: [tor-talk] REAL-ID Internet Access Coming Soon
by grarpamp 10 Feb '15

10 Feb '15

On Wed, Feb 4, 2015 at 10:15 PM, Max Bond <max.o.bond(a)gmail.com> wrote: > What are you proposing we do? As before, take these issues to the realworld political front. If you're a coder, you can write all the code you want. If you're a user, you can use whatever code you want. If you're EFF/ACLU, you can publish all the press releases and fight all the cases under already written laws you want. Yet politicians generally ignore the above groups because they don't have much if any direct political action component that affects them. What's needed is a permanent political fixture and operation similar to the American NRA. These guys have a real, ongoing, political agenda and impact. Candidates are actually afraid of and responsive to the NRA's political clout... before they get elected, and before laws get enacted... not after. The NRA email, fax, letter and call trees, and their members who visit their legislators and stage in public view... are very effective. Look at the banner scroller in the upper right half of their homepage... they have a broad and deep approach to issue outreach/embedding, even a lifestyle. Labor unions and others are common examples of such organization. They all do it by leveraging large monoculture bases to politics. The NRA is 3.5M - 5.0M members strong. They turn $250M/yr from that base (manufacturers too). They have little difference of opinion in their ranks. They are good at crafting and pitching political rhetoric, framing the conversation, and rendering complex issues into simple forms that resonate with their entire base. The EFF/ACLU representing the internet are tiny in comparison. Yet the internet has a household penetration rate of 70%, more than firearms rate of 35%... so a big untapped culture there. Finding 5 million (or 2% of population) internet users should be simple task. Unfortunately, right now there are many tens of flag groups [1] mostly doing their own thing on the net. That's not good enough, and is confusingly diverse to both users and politicians. They need to join together to craft and coordinate the users under a single general banner they've been subconsciously waiting to fall in line behind, and then start firing out actionable political things for them to do. Internet users could demonstrate solidarity on issues with a typical Million User March [1]. They need to start raking in money for their war chest and to fund ongoing operations, etc. Just like the NRA... doing everything needed to become, and be, a strong integrated ongoing political force to be reckoned with. [1] Carrying the various colored flags of privacy, anonymity, free speech, freedom, copyright/filesharing, no data collecting, mining, retention or sharing, user brokered data management, surveillance, crypto, etc. The whole spectrum of related issues. https://www.nraila.org/ https://en.wikipedia.org/wiki/National_Rifle_Association#Political_activity https://en.wikipedia.org/wiki/Gun_politics_in_the_United_States#Advocacy_gr… https://en.wikipedia.org/wiki/Gun_politics_in_the_United_States#Rights-base… https://en.wikipedia.org/wiki/Category:Lobbying_organizations_in_the_United… https://www.opensecrets.org/ https://www.nra.org/ https://www.nrablog.com/ https://www.youtube.com/user/TriggerTheVote https://en.wikipedia.org/wiki/Fight_for_the_Future https://en.wikipedia.org/wiki/Internet_Defense_League [ FftF/IDL are relatively dormant and reactionary than being ongoing political action ]

2 1