- cypherpunks - lists.cpunks.org

Re: Hackers spent at least a year spying on Mozilla to discover Firefox security holes – and exploit them
by Ryan Carboni 07 Sep '15

07 Sep '15

No wonder firefox is seemingly more insecure lately. Only choices now are chrome or a text-only browser.

3 3

Can the NSA break 100000 bit RSA assuming they have O(n^6) or O(n^12) factoring algorithm?
by Georgi Guninski 07 Sep '15

07 Sep '15

In 2010 I generated two RSA keys (and certs) of size above 100000 bits: [Full-disclosure] nonsense fun: 100 000 bit rsa key http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0384.html The keys/certs: http://archives.neohapsis.com/archives/fulldisclosure/2010-08/att-0384/gir.… (the certs might have expired but this doesn't matter). The private keys are included too. According to my mail they were generated in "about 30 hours on 1 core" and I used state of the art primality checking "pfgw". n is the size of the modulus in bits. Assume the much loved NSA has factoring algorithms of complexity O(n^6) or O(n^12) running on classical computers. Can the NSA break n=100000 without using owning/torture? Some computations suggest NO, especially for the second: sage: k=100000 sage: RR(k^6).log(2) 99.6578428466209 sage: RR(k^12).log(2) 199.315685693242 Comments about quantum computer that can break them are welcome too.

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by coderman 03 Sep '15

03 Sep '15

On 9/2/15, Tim Sammut <tim(a)teamsammut.com> wrote: > ... > - Cisco IOS (and likely other platforms) will immediately export flows > if the cache fills to capacity. This will result in flows being > exported in less than inactive timeout,.. there is a second limit here, which is the netflow channel capacity / storage limit, if you introduce simulated flows at a rate beyond this capacity, you may become unobservable (via loss) resulting in failure to correlate. this is why i asked about logical injection via userspace of billions of flows per minute as a resistance measure. (e.g. scapy or other raw inject across a border with cooperating peer, if needed.) best regards,

2 1

Article by me on B. Brown transcript
by Douglas Lucas 03 Sep '15

03 Sep '15

Hi cypherpunks, I obtained the transcript to journalist Barrett Brown's second and final sentencing hearing and wrote an article on it. The lengthy article is all about the right to link. Here's the article: http://revolution-news.com/barrett-brown-vs-the-dept-of-justice-defining-th… Here's the transcript (PDF): http://douglaslucas.com/files/BBLOL_Transcript_January_Sentencing.pdf Thanks, Douglas

1 0

Re: [tor-talk] hardware recommendations
by grarpamp 01 Sep '15

01 Sep '15

On Sun, Aug 30, 2015 at 5:49 PM, Jacob Appelbaum <jacob(a)appelbaum.net> wrote: > Intel has AMT and opaque microcode updates, other CPU vendors have > similar fun hardware features. > > Further reading regarding AMT from the FSF: > > https://www.fsf.org/blogs/community/active-management-technology Some Intel docs indicate that remote AMT requires their "LM" series lan controllers. The Intel programming guides and block diagrams indicate an ability to update (and perhaps by that to zero) the AMT and related firmware. Their general CPU microcode is signed. Didn't read far enough yet to tell the full scope of what is in their programming guides in these areas.

1 0

Parallel Polis Congress 2-4.10.2015 in Prague / Central Europe
by Pavol Luptak 31 Aug '15

31 Aug '15

Hello everybody, it would be my pleasure to invite you to cypherpunk conference Parallel Polis Congress 2015 that will take place during 2-4.10.2015 in Prague / Central Europe. Don't hesitate and join this great and unique event (more information below). Last year we had more than 1000 visitors from different countries, see the schedule http://www.paralelnipolis.cz/308/hackers-congress-paralelni-polis-2014-sche… Speakers already confirmed for this year - Lyn Ulbricht, Paul Rosenberg, !Mediengruppe Bitnik, Susanne Tarkowski Tempelhof, Julia Tourianski, Smuggler, Frank Braun, Slush, Stef, ..and much more. * Parallel Polis in theory Parallel Polis is a theoretical concept developed by Czech dissident Vaclav Benda (1942–1999) during the height of communist domination in Czechoslovakia in the 1970s. It was translated into English in 1978. Benda argues that in a repressed state, it is impossible to overturn corrupt social, economic and political institutions. Such efforts are futile. Instead, he suggests the creation of new "parallel institutions" that are more responsible to human needs. * Parallel Polis in practice We were impressed by the concept of Vaclav Benda’s Parallel Polis and Timothy C May’s Crypto Anarchistic Manifesto and Cyphernomicon. Embracing the current crypto-technologies we have realized a practical feasibility of these utopian theories and started a unique freedom think tank focused on the promotion of digital freedom, cryptocurrencies, anonymization networks and free markets. For this purpose we decided to rent a big 3-floor house (with almost 1000m2) in the center of Prague (Holešovice) - one floor dedicated to Bitcoin coffee-house, hub and hackerspace called Institute of Cryptoanarchy. :) * Founders of Parallel Polis Parallel polis is 100% state-free project, based on voluntary contributions only of our members and donors. Founding members are people from Czech contemporary-art group Ztohoven (http://ztohoven.com/) and group of cryptoanarchists from Czech and Slovak hackerspaces, see their recent projects Moral Reform (hack of Czech Parliament) http://juraj.bednar.sk/blog/2013/01/06/moral-reform-by-ztohoven-an-ultimate… and Citizen K ( http://artoftheprank.com/2010/06/19/ztohoven-art-collective-launch-citizen-… ) * Parallel Polis Congress and why we need you! Parallel Polis Congress is a 1-birthday party of a new era of our freedom. For such a unique event, we decided to invite all speakers whom we have loved and respected for a long time. * When & Where Parallel Polis Congress takes place in Parallel Polis building (Dělnická 43, Prague) during 2-4.10.2015. If you prefer to take public transport, take the tram number 1, 12, 14, 25, 53 or 54 to the tram station Dělnická. * Stay in touch http://hcpp.cz/ http://www.paralelnipolis.cz https://www.facebook.com/events/111132575904264/ https://twitter.com/Paralelni_polis -- ______________________________________________________________________________ [Parallel Polis - Bitcoin Coffee House, Hub and Cryptoanarchy hackerspace]

4 5

PROBLEM: Speech that Enables Speech: China Takes Aim at Its Coders
by Cari Machet 31 Aug '15

31 Aug '15

AUGUST 28, 2015 | BY DANNY O'BRIEN <https://www.eff.org/about/staff/danny-obrien-0> Speech that Enables Speech: China Takes Aim at Its Coders The maintainer of GoAgent, one of China's more popular censorship circumvention tools emptied out the project's main <https://github.com/phuslu/goagent/> source code repositories <https://github.com/goagent/goagent> on Tuesday. Phus Lu, the developer, renamed the repository’s description to “Everything that has a beginning has an end”. Phus Lu’s Twitter account's historywas also deleted, except for a single tweet <https://twitter.com/phuslu/status/636186971631677440> that linked to a Chinese translation of Alexander Solzhenitsyn’s “Live Not By Lies” <http://www.washingtonpost.com/wp-dyn/content/article/2008/08/04/AR200808040…>. That essay was originally published in 1974 on the day of the Russian dissident’s arrest for treason. We can guess what caused Phus Lu to erase over four years’ work on an extremely popular program from the brief comments of another Chinese anti-censorship programmer, Clowwindy. Clowwindy was the chief developer of ShadowSocks, another tool that circumvented the Great Firewall of China by creating an encrypted tunnel between a simple server and a portable client. Clowwindy also deleted his or her Github repositories last week. In a comment on the now empty Github archive Clowwindy wrote in English <https://en.greatfire.org/blog/2015/aug/chinese-developers-forced-delete-sof…> : Two days ago the police came to me and wanted me to stop working on this. Today they asked me to delete all the code from Github. I have no choice but to obey. https://www.eff.org/deeplinks/2015/08/speech-enables-speech-china-takes-aim… The author deleted that comment too shortly afterwards. Github, the host for both repositories, reported a DDoS attack on the days between these two incidents. While Github has not commented on the source of the current attack, the evidence strongly suggests <https://citizenlab.org/2015/04/chinas-great-cannon/> that a previous DDoS against Github in March was conducted by the Chinese government <https://www.eff.org/deeplinks/2015/04/china-uses-unencrypted-websites-to-hi…> to pressure the company to remove the repositories of two other anti-censorship programs. The Chinese government’s control of the Internet passes through regular waves of enhanced repression, often tied to a significant political event or protest. Many commentators have connected a current wave of media and Internet crackdowns <http://chinadigitaltimes.net/2015/08/beijing-shuts-commemoration-parade-reh…> to a forthcoming military parade commemorating World War II in Beijing on September 3. But even as a peak moment in a temporary spate of repression, the intimidation of GoAgent and ShadowSock’s creators represents a continuing escalation by the authorities against technologists. Chinese law has long forbidden the selling of telecommunication services that bypass the Great Firewall of China, as well as the creation or distribution of “harmful information”. Until recently, however, the authorities have not targeted the authors of non-commercial circumvention software, nor its users. Human Rights in China <http://www.hrichina.org/en>, a Chinese rights advocacy and research organization, told EFF that, based on its preliminary review, VPNs and circumvention software is not specifically prohibited under Chinese law. While the state interferes with people's ability to use such software, it has not outlawed the software itself. In November, Phus Lu wrote a public declaration to clarify <http://www.chinagfw.org/2014/11/goagent.html>this <http://www.chinagfw.org/2014/11/goagent.html>p <http://www.chinagfw.org/2014/11/goagent.html>oint. In the statement, he stated that he has received no money to develop GoAgent, provided no circumvention service, nor asserted any political view. Phus Lu’s caution at that time was prompted by the police questioning of another technologist, Xu Dong, a supporter of the Hong Kong opposition Umbrella Movement who was detained in the same month for “picking quarrels and creating disturbances” <http://chinachange.org/2014/11/12/young-it-professional-detained-for-develo…>. According to the Washington-based blog China Change, Xu Dong, who goes by the nym Onionhacker <https://twitter.com/onionhacker> online, had also been working on censorship circumvention code. During his detention he was told by the police that he had committed “crimes of developing software to help Chinese Internet users scale the Great Fire Wall of China.” Even if it's unclear what law Xu Dong had broken, if any, in November, the legal and political climate has grown even more aggressively anti-Internet since then. A new National Security Law <http://chinalawtranslate.com/2015nsl/?lang=en> came into effect on July 1 , which provides the authorities with a wide remit to oversee “internet information technology produces and services” that impact national security (Art. 59), as well as maintain “network sovereignty” <https://en.wikipedia.org/wiki/Network_Sovereignty> (Art. 25). It seems that is already being interpreted to include the creators of circumvention software. A sweeping bill on cyber-security <http://chinalawtranslate.com/cybersecuritydraft/?lang=en> is also in the works. The targeting of software developers by China is a new and worrying trend, but one that we’re seeing occur around the world. Authorities everywhere are realising that one way to sabotage free expression is to intimidate those who build the tools that enable that speech. Technologists like Phus Lu, Clowwindy and Xu Dong are now facing the same political scrutiny and intimidation in authoritarian regimes as independent writers, publishers, poets or journalists did in Solzhenitsyn’s time. Code is speech <https://www.eff.org/deeplinks/2015/04/remembering-case-established-code-spe…>: and using police intimidation to compel these creators to delete their code repositories is as serious a violation of human rights law as compelling a writer to burn his or her own books. It’s also as ultimately futile: while the Chinese authorities have chosen to target and disrupt two centralised stores of code, thousand of forked copies of the same software exist—both on other accounts on Github and in private copies around the Net. ShadowSocks and GoAgent represent hours of creative work for their authors, but the principle behind them is reproducible by many other coders. The Great Firewall may be growing more sophisticated in detecting and blocking new circumvention systems, but even as it does so, so new code blossoms. Meanwhile the intimidation of programmers remains a violation of the human rights of the coder—and a blow to the rights of everyone who relies on their creativity to exercise their own rights. .O. ..O OOO -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

1 0

UH OH: Windows 10 will share your Wi-Fi key with your friends' friends
by Georgi Guninski 30 Aug '15

30 Aug '15

This is old, but I don't do windows. In addition the screenshot of the phone appears not privacy friendly to me. http://www.theregister.co.uk/2015/06/30/windows_10_wi_fi_sense/ <quote> Those friends include their Outlook.com (nee Hotmail) contacts, Skype contacts and, with an opt-in, their Facebook friends. If you wander close to a wireless network, and your friend knows the password, and you both have Wi-Fi Sense, you can log into that network. Wi-Fi Sense doesn’t reveal the plaintext password to your family, friends, acquaintances, and the chap at the takeaway who's an Outlook.com contact, but it does allow them, if they are also running Wi-Fi Sense, to log in to your Wi-Fi. The password must be stored centrally by Microsoft, and is copied to a device for it to work; Microsoft just tries to stop you looking at it. How successful that will be isn't yet known. The feature has been on Windows Phones since version 8.1. If you type the password into your Lumia, you won’t then need to type it into your laptop, because you are a friend of yourself. </quote>

5 7

Re: Augur: blockchain based internet prediction market
by tigrutigru＠gmail.com 30 Aug '15

30 Aug '15

Eh, how come it's uses Ethereum chain and money is in btc? Can't be right. > On 26 Aug 2015, at 8:20 am, cypherpunks-request(a)cpunks.org wrote: > > Subject: Augur: Blockchain-based Internet prediction market. > Message-ID: > <732253587.632877.1440556303234.JavaMail.yahoo(a)mail.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > http://reason.com/blog/2015/08/11/augur-gambling-prediction-ethereum > > > Augur May Become the Greatest Gambling Platform in History. Is There Anything the Government Can Do to Stop It? > A blockchain-based prediction market that won’t be controlled or managed by anyone. > Jim Epstein Aug. 11, 2015 12:36 pm > > An online gambling platform could do to the neighborhood bookie what electric refrigerators did to the ice delivery man. > Coming this fall, Augur will allow participants to wager money on any future event of their choosing. Software will set the odds, collect the bets, and disperse the winnings. The price alone should give Nevada sportsbook operators pause; an estimated one percent of every pot will go to keep the system running. The average vig today is about 10 times that. > Augur isn't a full-fledged casino. You can't play roulette or poker, and running lotto on the platform would be tricky. But it'll be great for sports betting. > Here’s what’s truly novel about Augur: It won’t be controlled by any person or entity, nor will it operate off of any one computer network. > All the money in the system will be in Bitcoin, ??? May be in Ether? > or other types of peer-to-peer cryptocurrency, so no credit card companies or banks need to be involved. If the system runs afoul of regulators—and if it’s successful, it most certainly will—they'll find that there's no company to sue, no computer hardware to pull out of the wall, and no CEO to lockup in a cage.This is new legal territory. If Augur catches on as a tool for betting on everything from basketball games to stock prices, is there anything the government can do to stop it? > Augur is a decentralized peer-to-peer marketplace, a new kind of entity made possible by recent breakthroughs in computer science. The purpose of these platforms is to facilitate the exchange of goods and services among perfect strangers on a platform that nobody administers or controls. Augur’s software will run on what’s known as a “blockchain"—a concept introduced in 2008 with the invention of Bitcoin—that's essentially a shared database for executing trades that's powered and maintained by its users. > Bitcoin’s blockchain was designed as a banking ledger of sorts—kind of like a distributed Microsoft Excel file—but Augur will utilize a groundbreaking new project called Ethereum How is it possible to put btc on Ethereum chain? And, even weirder, take them out? > that expands on this concept. Ethereum allows Augur's entire system to live on the blockchain. That means the software and processing power that makes Augur function will be distributed among hundreds or thousands of computers. Destroying Augur would involve unplugging the computers of everyone in the world participating in the Ethereum blockchain. > If Augur is destined to become the cypherpunks answer to gambling prohibition—the betting man’s version of the online drug market Silk Road if you will—you'd never know it from talking with its developers. They work for a San Francisco-based nonprofit, attend conferences, have legal representation, and talk openly about what they’re up to with reporters. Augur even commissionedone of those cheesy motion graphics promotional videos favored by new tech startups. > About half of the roughly $600,000 raised by Augur's development team comes from Joe Costello, the successful tech entrepreneur who was once Steve Jobs' top pick to become the CEO of Apple. > Joey Krug, a twenty-year-old Pomona college dropout and Augur's lead developer, never uses the world “gambling" to describe his venture. He and his team of five employees call Augur a “prediction market,” a term that emphasizes the information generated when a bunch of people have a financial incentive to feed their expertise into a sophisticated algorithm. > With Augur, as bettors move money in and out of the pot, the odds adjust. This yields publicly available statistics that should carry weight because they're derived from the opinions of a crowd of people with a stake in the results. InTrade, for example, the best-known prediction market until federal regulators forced it to stop serving U.S. customers in 2012, beat the pollsters and pundits by foreseeing the outcome of the 2008 presidential elections in 48 out of 50 states. > Augur’s developers hope that their platform will make it possible to do a Google search to look up the likelihood of some future event. This could usher in a better world, with more informed policy decisions and less malinvestment. > But Augur also serves the less high-minded—though no less noble—purpose of providing cost savings and convenience to gamblers. Restrictions on gambling serve to protect government revenue at the betting man's expense. State-sanctioned casino operators pay high taxes, and state-run lotteries fleece their customers. But there's no logical or moral case for government restrictions on gambling, since no third party is harmed when consenting adults wager money on the future. Augur actually has the potential to make the world safer by taking away market share in the gambling industry from criminals. > And yet sports betting is illegal in most states, and prediction markets are tightly regulated by the Commodity Futures Trading Commission (CTFC). The agency sued Ireland-based InTrade in 2012 to prevent it from accepting bets from U.S. customers. (The company folded shortly after.) In 2013, the CFTC and the Securities and Exchange Commission (SEC) jointly sued the prediction market Banc de Binary for allowing U.S. customers to make bets on commodity prices. > The CFTC has approved other prediction markets, such as the New Zealand-based PredictIt, but only after it agreed to abide by the agency's restrictions. > Krug says the Augur team is planning to meet with CFTC staff go over how their system works before it’s launched, but says he's not overly concerned. “Our friends in Washington, D.C. say the CFTC will probably just dismiss Augur and say it’s not a big deal,” Krug told me in a phone interview. > That doesn’t sound like much of a legal strategy, but how do you have a legal strategy when you're building something unlike anything that's ever existed? Federal anti-gambling laws, such as the 2006 Unlawful Internet Gambling Enforcement Act, target the companies that facilitate online betting— website operators, credit card companies, banks—not individual gamblers. > Augur’s biggest legal vulnerability is the community of human “reporters” who are needed to settle bets on the platform, says Cardozo Law School's Aaron Wright, who is writing a book about the legal implications of blockchain technology. Let’s say a group of people wager money on Augur over the outcome of a boxing match. Once the bout is over, human participants (who receive a portion of the trading fees as compensation) must report the outcome to the system before Augur’s software will disperse the money to the winners. "There’s at least an argument that the people doing that reporting are aiding or abetting unlicensed options and could be prosecuted," says Wright. > But Augur doesn't collect personal information on any of its users, so identifying these people could be difficult. And Augur is a borderless technology, so U.S. gamblers could simply rely on foreigners to report on the outcomes of their bets. > One attorney I spoke with suggested that the team that’s building Augur could be brought up on charges for aiding and abetting a criminal conspiracy. Nate Cardozo, a staff attorney with the Electronic Frontier Foundation, thinks that's far-fetched but says he can't rule it out. Cardozo emphasizes that writing open source software doesn’t necessarily protect the team from prosecution. > “We’ve taken the steps that we need to take in order to bracket the individual's risk and the organization’s risk,” says Augur’s attorney, Marco Santori, who declined to comment further on exactly what those steps might entail. > Even if Krug and his colleagues were to face criminal prosecution, the technology would live on. After Augur is born into the world, the development team could release a software update that would cripple the system. But in that case, Augur's users could band together to block any changes to the underlying code, or another developer could copy the open source code and simply re-launch the platform. > The big question with Augur—and with blockchain platforms more generally—is whether they can outrun our regulatory state long enough to grow so large and popular that they're truly unstoppable. My money’s on Augur in that race. > For more on the promises and pitfalls of decentralized peer-to-peer marketplaces, read my recentReason magazine feature story on the topic. >

1 0

Re: [tor-relays] clarification on what Utah State University exit relays store ("360 gigs of log files")
by grarpamp 30 Aug '15

30 Aug '15

While reducing network traffic to various accounting schemes such as netflow may enable some attacks, look at just one field of it... bytecounting. Assume you've got a nice global view courtesy of your old bed buddies AT&T, Verizon, Sprint, etc and in addition to your own bumps on the cables. You know the IP's of all Tor nodes (and I2P, etc). So you group them into one "cloud" of overlay IP's. For the most part any traffic into that cloud from an IP on the left, after it bounces around inside, must terminate at another IP on the right. There are roughly 7000 relays, but because many of them are aggregable at the ISP/colohouse, peering and other good vantage point levels, you don't need 7000 taps to see them all. You run your client and start loading and unloading the bandwidth of your target in one hour duty cycles for a few days. Meanwhile, record the bytecount every minute for every IP on the internet into some RRD. There are only about 2.8 billion IPv4 in BGP [Potaroo]. Some usage research says about 1.3 billion of 2.6 billion BGP actually in use [Carna Census 2012]. IPv6 is minimal, but worth another 2.8 billion if mapped today. Being generous at 3.7 billion users (half the world [ITU]), that's 2^44 64-bit datapoints every three days... 128TiB. Now, can you crunch those 3.7B curves to find one whose bytecount deltas match those of your datapump? How fast can you speed it up? And can you find Tor clients of clearnet services using similar method since you are not the datapump there? What if you're clocking out packets and filling all the data links on your overlay net 24x7x365 such that any demand loading is now forced to ride unseen within instead of bursting out the seams?

5 5