- cypherpunks - lists.cpunks.org

Software Licenses prove no obstacle to abuse by abusive actors (eg: HESSLA)
by grarpamp 24 Jun '15

24 Jun '15

https://firstlook.org/theintercept/2015/06/22/nsa-gchq-targeted-kaspersky/ https://firstlook.org/theintercept/document/2015/06/22/gchq-warrant-renewal/ GCHQ felt it needed [secret] legal cover to conduct [the activity], writing in the warrant renewal application that the practice could otherwise be “unlawful” and amount to “a copyright infringement or breach of contract." ... The warrant ... applies ... to intellectual property ... and to certain categories of domestic policing. ... In each case it was necessary to use this warrant as the product license explicitly forbade [the activity]. ... etcetera...

1 0

Bahraini government's attempt to slow down the internet during 'Arab Spring' disturbances unsuccessful
by Razer 23 Jun '15

23 Jun '15

Methinks this is really more appropriately titled 'attempt to slow down uprising *communication*' but FYI: It /(Saudi diplo-dox released by wikileaks)/ also mentions the Bahraini government's attempt to slow down the internet was not successful because Shiite activists have other ways of communicating, while those that work with international organizations have phones provided for them. Wikileaks Docs Reveal Saudi intrigues against Bahrain’s Arab Spring http://www.juancole.com/2015/06/wikileaks-intrigues-bahrains.html Interpretation of more Saudi wikileaks dox onsite

1 0

Re: Be alert - signs of Russian invasion may be strong
by John Young 23 Jun '15

23 Jun '15

Official secretkeepers of NATO, Russia and their fearsome enemies know these kinds of stories are meant to reduce fear and defense expenditures so should be applauded as tricks of the anti-war industry which must be resisted with fearless slaughter of many terrified civilians and a tiny few luckless warfighters who drive drunk to the PTSD club and overshoot (over-drone) a construction barrier of the crumbling National Defense Highway system to sink into a toxic lake of endless war waste surrounding every military base on the planet and rapidly growing throughout the universe with application of war technology to invasion of the heavens for peaceful, merely scientific, although top secret, purposes, that is to erect intergalactic shields of protection of hapless creatures being drained of their vital fluids for nourishing the Great Gods of National and Environmental Security, now blessed by Pope Francis for the benefit of Great Architecture afficionados from St Peter to Pentagon to whereever Strangeloves squat before vast Sony plasmas of roach-squashing, fail/safe buttons neutered, flesh life as known and loathed by cryogenic demigodly automatons aimed for extinction. At 08:45 PM 6/20/2015, you wrote: >Grab a coffee for this one. > >http://russia-insider.com/en/russian-non-invasion-causing-concern-european-… > >I hope it's not too shocking for folks around here.

4 3

Fwd: [ PFIR ] Lauren's Blog: "DOJ vs. Google: How Google Fights on Behalf of Its Users"
by Zenaan Harkness 23 Jun '15

23 Jun '15

---------- Forwarded message ---------- From: "PFIR (People For Internet Responsibility) Announcement List" <pfir(a)pfir.org> Date: Mon, 22 Jun 2015 15:47:11 -0700 Subject: [ PFIR ] Lauren's Blog: "DOJ vs. Google: How Google Fights on Behalf of Its Users" To: pfir-list(a)pfir.org DOJ vs. Google: How Google Fights on Behalf of Its Users http://lauren.vortex.com/archive/001110.html One of the oft-repeated Big Lies -- still bandied about by Google haters today -- is the false claim that Google enthusiastically turns over user data to government agencies. This fallacy perhaps reached its zenith a few years ago, when misleading PowerPoint slides from Edward Snowden's stolen NSA documents cache were touted by various commercial parties (with whom he had entrusted the data), in a misleading, out-of-context manner, designed for maximum clickbait potential. The slides were publicized by these parties with glaring headlines suggesting that Google permitted NSA to freely rummage around through Google data centers, grabbing goodies like a kid set loose in a candy store. Google immediately and forcefully denied these claims, and for anyone familiar with the internal structure and dialogues inside Google, these allegations were ludicrous on their face. (Full disclosure: While I have consulted to Google in the relatively recent past, I am not currently doing so.) Even an attempt to enable such access for NSA or any other outside party would have by necessity involved so many engineers and other Google employees as to make impossible any ability to keep such an effort secret. And once known, there would have been very public, mass resignations of Googlers -- for such an intrusion would strike directly at the heart of Google philosophy, and the mere suggestion of such a travesty would be utter anathema to Google engineers, policy directors, lawyers, and pretty much everyone else at the firm. Obviously, Google must obey valid laws, but that doesn't mean they're a pushover -- exactly the opposite. While some companies have long had a "nod and wink" relationship with law enforcement and other parts of government -- willingly turning over user data at mere requests without even attempting to require warrants or subpoenas, it's widely known that Google has long pushed back -- sometimes though multiple layers of courts and legal processes -- against data requests from government that are not accompanied by valid court orders or that Google views as being overly broad, intrusive, or otherwise inappropriate. Over the last few days the public has gained an unusually detailed insight into how hard Google will fight to protect its users against government overreaching, even when this involves only a single user's data. The case reaches back to the beginning of 2011, when the U.S. Department of Justice tried to force Google to turn over more than a year's worth of metadata for a user affiliated with WikiLeaks. While these demands did not include the content of emails, they did include records of this party's email correspondents, and IP addresses he had used to login to his Gmail account. Notably, DOJ didn't even seek a search warrant. They wanted Google to turn over the data based on the lesser "reasonable grounds" standard rather than the "probable cause" standard of a search warrant itself. And most ominously, DOJ wanted a gag order to prevent Google from informing this party that any of this was going on, which would make it impossible for him to muster any kind of legal defense. I'm no fan of WikiLeaks. While they've done some public good, they also behave as mass data dumpers, making public various gigantic troves of usually stolen data, without even taking basic steps to protect innocent persons who through no fault of their own are put at risk via these raw data dumps. WikiLeaks' irresponsible behavior in this regard cannot be justified. But that lack of responsibility doesn't affect the analysis of the Gmail case under discussion here. That user deserved the same protection from DOJ overreaching as would any other user. The battle between Google and DOJ waged for several months, generating a relatively enormous pile of associated filings from both sides. Ultimately, Google lost the case and their appeal. This was still back in 2011. The gag order continued and outside knowledge of the case was buried by government orders until April of 2015 -- this year! -- when DOJ agreed to unseal some of the court records -- though haphazardly (and in some cases rather hilariously) redacted. These were finally turned over to the targeted Gmail user in mid-May -- triggering his public amazement at the depth and likely expense of Google fighting so voraciously on his behalf. Why did DOJ play such hardball in this case, particularly involving the gag order? There's evidence in the (now public) documents that the government wanted to avoid negative publicity of the sort they assert occurred with an earlier case involving Twitter, and DOJ was willing to pull out all the stops to prevent Google from even notifying the user of the government's actions. You don't need to take my word on any of this. If you have some time on your hands, the over 300 pages of related filings are now available for your direct inspection: https://drive.google.com/file/d/0B5L6chr0QvNzbTJNMXpiQWllNG8/view?usp=shari… So the next time someone tries to make the false claim that Google doesn't fight for its users, you can print out that pile of pages and plop it down right in front of them. Or save the trees and just send them the URL. Either way, the truth is in the reading. Be seeing you. --Lauren-- Lauren Weinstein (lauren(a)vortex.com) http://www.vortex.com/lauren Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com _______________________________________________ pfir mailing list http://lists.pfir.org/mailman/listinfo/pfir

1 0

PandoDaily "Revamps" Launch Partner... Wait for it... Cloudflare
by Razer 22 Jun '15

22 Jun '15

Since Pando's Yasha Levine wrote what I consider to be the seminal piece about Cloudflare's affiliation with federal spying back in his eXiled days and hinted at their connection to domestic spying I figure Pando's knowingly sold out to federal domestic spying. https://pando.com/2015/06/22/welcome-new-pando/ What do imprisoned journalist Barrett Brown's "Project PM" domestic spying research site, the supposedly secure email service "Hushmail", the "New Pirate Bay" torrent site, a Ferguson organizing site, an 'apology letter to Vladimir Putin' site, and ISIS' most popular chat rooms all have in common? They're all being, or have been domain name served/stalked by the Domestic Spying organization "CloudFlare" http://auntieimperial.tumblr.com/post/119691050059

3 2

Re: Google has been stealth downloading audio listeners onto every computer that runs Chrome
by BizDevCon 22 Jun '15

22 Jun '15

On Chrome for Mac OS X the setting Enable "Ok Google" to start a voice search. was *NOT*, I repeat not, enabled by default on my computer. -BizDevCon -------- Original Message -------- Subject: Re: Google has been stealth downloading audio listeners onto every computer that runs Chrome Time (GMT): Jun 21 2015 22:14:03 From: alfiej(a)fastmail.fm To: cypherpunks(a)cpunks.org On Mon, Jun 22, 2015, at 07:41 AM, Kurt Buff wrote: > That's pretty easy. Fire up wireshark, look for packets heading to google- > owned addresses. > > Kill off processes one by one until you see those packets stop. > > You have found your culprit. If you check for packets moving but see nothing, it only proves that it's _currently_ not recording. It's the capability that they _can_ turn it on via a push update is what get me. And all it takes is a warrant if you're a US citizen. If not a US citizen, you're fair game. Alfie -- Alfie John alfiej(a)fastmail.fm

1 0

Re: Google has been stealth downloading audio listeners onto every computer that runs Chrome
by BizDevCon 22 Jun '15

22 Jun '15

On Chrome for Mac OS X the setting Enable "Ok Google" to start a voice search. was *NOT*, I repeat NOT, enabled by default on my computer. -BizDevCon -------- Original Message -------- Subject: Re: Google has been stealth downloading audio listeners onto every computer that runs Chrome Time (GMT): Jun 21 2015 22:14:03 From: alfiej(a)fastmail.fm To: cypherpunks(a)cpunks.org On Mon, Jun 22, 2015, at 07:41 AM, Kurt Buff wrote: > That's pretty easy. Fire up wireshark, look for packets heading to google- > owned addresses. > > Kill off processes one by one until you see those packets stop. > > You have found your culprit. If you check for packets moving but see nothing, it only proves that it's _currently_ not recording. It's the capability that they _can_ turn it on via a push update is what get me. And all it takes is a warrant if you're a US citizen. If not a US citizen, you're fair game. Alfie -- Alfie John alfiej(a)fastmail.fm

1 0

Google has been stealth downloading audio listeners onto every computer that runs Chrome
by Seth 22 Jun '15

22 Jun '15

from https://www.privateinternetaccess.com/blog/2015/06/google-chrome-listening-… Posted on June 18, 2015 by Rick Falkvinge Google Chrome Listening In To Your Room Shows The Importance Of Privacy Defense In Depth Yesterday, news broke that Google has been stealth downloading audio listeners onto every computer that runs Chrome, and transmits audio data back to Google. Effectively, this means that Google had taken itself the right to listen to every conversation in every room that runs Chrome somewhere, without any kind of consent from the people eavesdropped on. In official statements, Google shrugged off the practice with what amounts to “we can do that”. It looked like just another bug report. "When I start Chromium, it downloads something." Followed by strange status information that notably included the lines "Microphone: Yes" and "Audio Capture Allowed: Yes". chrome-voicesearch Without consent, Google’s code had downloaded a black box of code that – according to itself – had turned on the microphone and was actively listening to your room. A brief explanation of the Open-source / Free-software philosophy is needed here. When you’re installing a version of GNU/Linux like Debian or Ubuntu onto a fresh computer, thousands of really smart people have analyzed every line of human-readable source code before that operating system was built into computer-executable binary code, to make it common and open knowledge what the machine actually does instead of trusting corporate statements on what it’s supposed to be doing. Therefore, you don’t install black boxes onto a Debian or Ubuntu system; you use software repositories that have gone through this source-code audit-then-build process. Maintainers of operating systems like Debian and Ubuntu use many so-called “upstreams” of source code to build the final product. Chromium, the open-source version of Google Chrome, had abused its position as trusted upstream to insert lines of source code that bypassed this audit-then-build process, and which downloaded and installed a black box of unverifiable executable code directly onto computers, essentially rendering them compromised. We don’t know and can’t know what this black box does. But we see reports that the microphone has been activated, and that Chromium considers audio capture permitted. This was supposedly to enable the “Ok, Google” behavior – that when you say certain words, a search function is activated. Certainly a useful feature. Certainly something that enables eavesdropping of every conversation in the entire room, too. Obviously, your own computer isn’t the one to analyze the actual search command. Google’s servers do. Which means that your computer had been stealth configured to send what was being said in your room to somebody else, to a private company in another country, without your consent or knowledge, an audio transmission triggered by… an unknown and unverifiable set of conditions. Google had two responses to this. The first was to introduce a practically-undocumented switch to opt out of this behavior, which is not a fix: the default install will still wiretap your room without your consent, unless you opt out, and more importantly, know that you need to opt out, which is nowhere a reasonable requirement. But the second was more of an official statement following technical discussions on Hacker News and other places. That official statement amounted to three parts (paraphrased, of course): 1) Yes, we’re downloading and installing a wiretapping black-box to your computer. But we’re not actually activating it. We did take advantage of our position as trusted upstream to stealth-insert code into open-source software that installed this black box onto millions of computers, but we would never abuse the same trust in the same way to insert code that activates the eavesdropping-blackbox we already downloaded and installed onto your computer without your consent or knowledge. You can look at the code as it looks right now to see that the code doesn’t do this right now. 2) Yes, Chromium is bypassing the entire source code auditing process by downloading a pre-built black box onto people’s computers. But that’s not something we care about, really. We’re concerned with building Google Chrome, the product from Google. As part of that, we provide the source code for others to package if they like. Anybody who uses our code for their own purpose takes responsibility for it. When this happens in a Debian installation, it is not Google Chrome’s behavior, this is Debian Chromium’s behavior. It’s Debian’s responsibility entirely. 3) Yes, we deliberately hid this listening module from the users, but that’s because we consider this behavior to be part of the basic Google Chrome experience. We don’t want to show all modules that we install ourselves. If you think this is an excusable and responsible statement, raise your hand now. Now, it should be noted that this was Chromium, the open-source version of Chrome. If somebody downloads the Google product Google Chrome, as in the prepackaged binary, you don’t even get a theoretical choice. You’re already downloading a black box from a vendor. In Google Chrome, this is all included from the start. This episode highlights the need for hard, not soft, switches to all devices – webcams, microphones – that can be used for surveillance. A software on/off switch for a webcam is no longer enough, a hard shield in front of the lens is required. A software on/off switch for a microphone is no longer enough, a physical switch that breaks its electrical connection is required. That’s how you defend against this in depth. Of course, people were quick to downplay the alarm. “It only listens when you say ‘Ok, Google’.” (Ok, so how does it know to start listening just before I’m about to say ‘Ok, Google?’) “It’s no big deal.” (A company stealth installs an audio listener that listens to every room in the world it can, and transmits audio data to the mothership when it encounters an unknown, possibly individually tailored, list of keywords – and it’s no big deal!?) “You can opt out. It’s in the Terms of Service.” (No. Just no. This is not something that is the slightest amount of permissible just because it’s hidden in legalese.) “It’s opt-in. It won’t really listen unless you check that box.” (Perhaps. We don’t know, Google just downloaded a black box onto my computer. And it may not be the same black box as was downloaded onto yours. ) Early last decade, privacy activists practically yelled and screamed that the NSA’s taps of various points of the Internet and telecom networks had the technical potential for enormous abuse against privacy. Everybody else dismissed those points as basically tinfoilhattery – until the Snowden files came out, and it was revealed that precisely everybody involved had abused their technical capability for invasion of privacy as far as was possible. Perhaps it would be wise to not repeat that exact mistake. Nobody, and I really mean nobody, is to be trusted with a technical capability to listen to every room in the world, with listening profiles customizable at the identified-individual level, on the mere basis of “trust us”. Privacy remains your own responsibility. Rick Falkvinge ABOUT RICK FALKVINGE Rick is the founder of the first Pirate Party and is a political evangelist, traveling around Europe and the world to talk and write about ideas of a sensible information policy. He has a tech entrepreneur background and loves whisky. Read more of his articles on his website. Twitter |More Posts (91)

7 7

Warrant Canaries are Bullshit
by coderman 22 Jun '15

22 Jun '15

it's simple: if you can't run it robustly, FADE TO BLACK. the canary dies when you shut off the service. anything else is posturing or pointless... [0]. best regards, 0. this leads to follow up questions, which may be: Qa) what about the legality? Aa: irrelevant as the canary, too. Qb) how to run the service? Ab: all onions, all the time![1] Qc) but my business is monitizing user data exhaust!? FinalAnswer: we're coming to make you worse than obsolete. you're a moral hazard and proven risk! 1. All onions, all the time, no DNS, no cloudbullshit, now past 1yr mark. it is possible past the growing pains! 20-30 minute typical bootstrap of friend/family/peer onto onion services. XMPP+OTR, Onionpad, GPGw/out email, Anonfilehost developer services? this a harder nut to crack. but possible; takes more than scores of minutes, however. SSSSSS. they NSL's your onion? you done fucked up somewhere, sad earth human. , time to burn onions and keys, three degrees out, :P

1 0

Be alert - signs of Russian invasion may be strong
by Zenaan Harkness 22 Jun '15

22 Jun '15

Grab a coffee for this one. http://russia-insider.com/en/russian-non-invasion-causing-concern-european-… I hope it's not too shocking for folks around here.

2 3