- cypherpunks - lists.cpunks.org

Encrypted mailing lists and anonymous collaboration
by Mike Ingle 15 Feb '15

15 Feb '15

Confidant Mail now has a beta encrypted mailing list feature. It works like a normal mailing list in that you send a message to the listserv address and the message is remailed to all the recipients. Unlike regular mailing lists, access is controlled by public keys, so only a list of approved keys can send to the list. The messages are signed by the listserv's key, and by clicking Show Original you can also check the signature of the original sender. Large file attachments can be included in mailing list posts. Confidant Mail can operate through Tor or I2P, so anonymous participants can take part in a discussion without exposing their real-world identities. In addition to the mailing list feature, I have added a file server. You can send attachments to the file server, and they will be saved to a shared directory. Other users can send get requests to retrieve the files. There is an access control list, so specific public keys can be granted read-only, write, or overwrite access. Using the mailing list and file server, it is easy for a small group to collaborate on a project while some or all of them remain anonymous. Even the operator of the listserv can be anonymous behind Tor. Please email me if you want to help test this out. Mike Ingle <mike(a)confidantmail.org> d2b89e6f95e72e26e0c917d02d1847dfecfcd0c2

1 0

Hackers CAN Solve Surveillance
by grarpamp 14 Feb '15

14 Feb '15

Hackers can't solve Surveillance? No, hack*ing* can't solve surveillance. Hacking is a bandaid that carries no political or legal weight whatsoever. All of it can be brushed aside with the simple stroke of a pen. Yet hack*ers* CAN solve surveillance. However currently, they simply are not doing anything useful there. Here's some examples of what hackers are doing in just the news from today... They're giggity about features... http://tech.slashdot.org/story/15/02/12/2323200/facebook-adds-legacy-contac… Trying to get hired at companies that have questionable loyalties to their users... http://apple.slashdot.org/story/15/02/13/2338234/apple-hiring-automotive-ex… Putting the wrong spin on their own inventions... http://it.slashdot.org/story/15/02/13/1548202/new-encryption-method-fights-… And masturbating over version numbers as usual... http://linux.slashdot.org/story/15/02/13/1341213/torvalds-polls-desire-for-… Meanwhile... Since hackers weren't speaking up as to what they wanted politically and steering the decisions there, Corp and Gov tired of waiting for their leadership and decided to come up with their own plans in the vacuum... http://yro.slashdot.org/story/15/02/13/1711225/tech-industry-in-search-of-l… Nations are now asking them for their "papers please"... http://tech.slashdot.org/story/15/02/13/1821249/eu-preparing-vast-air-passe… Figuring out more ways to collect and share your privates and rape your devices... http://tech.slashdot.org/story/15/02/13/141215/iowa-wants-to-let-you-carry-… And the whole world is conspiring to royally fuck them and their ideas... http://yro.slashdot.org/story/15/02/13/2259255/trans-pacific-partnership-en… Today's freedom score is, ZERO for you, and FOUR for them. Hackers among you... hacking is NOT just about what comes out of your keyboard while heads down staring at it. It is, and now must be, more about what comes out of your mouth while standing up in the political arena. Code is a byproduct of and requires the freedom to write and use it. Those freedoms are being ripped out from under you while you sleep off your last all night coding session. It's time to wake up and get out from behind your keyboards. No one is going to do it for you.

2 1

Re: Security/Privacy Tradeoff - Dave DeWalt of Mandiant
by John Young 14 Feb '15

14 Feb '15

Well, it has been a generation since this standard business practice was challenged. And then went to covert cooperation to placate consumer anger. Why would a new generation not do the same as their mentors? Even here, among hackers, in universities, in corporations, in government, hats change colors, as heads and wallets and guts fatten. Hellman has said he regrets releasing PKC, succumbing to a young man's and scholar's desire for publicity over bland government secrecy. Now thinks national security is bigger than individual desire. This is the arc of maturity, especially from those who did gain publicity early on and now welcome invitations to serve as official advisors. Our cpunk heros Whit Diffie and David Wagner are serving as reviewers for NSA best cybersecurity paper. Others are invited to NSA and Congress to provide counsel to policymakers. Others peddle crypto to governments and corporations as if RSA, Google, Apple, Facebook, Twitter, the AV hustlers are the required standard of duplicity demanded by investors. At 12:08 AM 2/14/2015, Travis Biehn wrote: > From the article > <http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca…>http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca… > >"Dave DeWalt, CEO of security firm Mandiant, a participant in >Friday's summit, hopes that fear of privacy invasion won't get in >the way of the work that needs to get done. He pointed to the way >the way public backlash to government surveillance programs revealed >by former NSA contractor Edward Snowden stymied previous efforts to >effectively open the lines of communication. > >"This balance between privacy and security ebbs and flows and >unfortunately that was a huge setback -- a setback to the tune of >several years," he said. >" > >This is the first that I've ever heard of a tradeoff between privacy >and security in the context of 'cyber security'. >It's interesting to see this common trope for justifying widespread >erosion of privacy in meatspace applied to 'cyber', where it is even >more egregiously wrong. > >Travis

1 0

Business Wants Accessible Crypto from Business
by John Young 14 Feb '15

14 Feb '15

<http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca…>http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca… "Dave DeWalt, CEO of security firm Mandiant, a participant in Friday's summit, hopes that fear of privacy invasion won't get in the way of the work that needs to get done. He pointed to the way the way public backlash to government surveillance programs revealed by former NSA contractor Edward Snowden stymied previous efforts to effectively open the lines of communication. "This balance between privacy and security ebbs and flows and unfortunately that was a huge setback -- a setback to the tune of several years," he said. via cypherpunks

1 0

Re: Hackers can’t solve Surveillance
by shelley＠misanthropia.org 14 Feb '15

14 Feb '15

---------- On February 13, 2015 10:43:21 AM Georgi Guninski <guninski(a)guninski.com> wrote: > On Fri, Feb 13, 2015 at 02:25:34PM -0300, hellekin wrote: > > > I am a bit paranoid about HACKERSPACE, since likely the > > > dear NSA might have infiltrated it. > > > > > *** Then terrorists win. > > The paranoid in me is not sure what is considered "terrorist" > nowadays. > > I am pretty sure some of the heroes I studied in high school > are considered "terrorist"s nowadays. Your paranoia may not be without merit. The TLAs consider people who quote the 'founding fathers' or who invoke the Constitution (and not just the NRA-level gun nuts) to be ter'rists. People who use encryption or pay for their daily caffeine fix with cash (or, gods forbid, btc) are deemed worthy of scrutiny. So, yeah... most of us on this list are already screwed (at least the ones who aren't TLA spies and pigkissers themselves.)

2 1

Security/Privacy Tradeoff - Dave DeWalt of Mandiant
by Travis Biehn 14 Feb '15

14 Feb '15

>From the article http://www.cbsnews.com/news/obamas-cybersecurity-plan-why-the-government-ca… "Dave DeWalt, CEO of security firm Mandiant, a participant in Friday's summit, hopes that fear of privacy invasion won't get in the way of the work that needs to get done. He pointed to the way the way public backlash to government surveillance programs revealed by former NSA contractor Edward Snowden stymied previous efforts to effectively open the lines of communication. "This balance between privacy and security ebbs and flows and unfortunately that was a huge setback -- a setback to the tune of several years," he said. " This is the first that I've ever heard of a tradeoff between privacy and security in the context of 'cyber security'. It's interesting to see this common trope for justifying widespread erosion of privacy in meatspace applied to 'cyber', where it is even more egregiously wrong. Travis

2 1

Russians--including BU CompSci Professor--Propose Limiting Access to Tor & Anonymizers
by Andrew 14 Feb '15

14 Feb '15

http://inform-24.com/4114-leonid-levin-zasluzhivaet-vnimaniya-vopros-o-dosu… Summary: Leonid Levin, notable professor at Boston University, who themselves run a heavily-trafficked Tor exit node, attacks Tor and supports state control of information. English translation: > Leonid Levin: "we should pay attention" to the question about pre-trial[?] blocking of anonymizers and ways to access anonymizing networks such as Tor. > > The committee chair of the State Duma (parliament) on Information Policy, Information Technologies and Communications, Leonid Levin, suggested to consider the question about limiting access to the Tor anonymizer internet-network. He said it during "Infoforum2015". > > By his words, this restriction would allow not only limiting access via anonymizing networks to information forbidden for distribution, but also would "extend the potential" for counteraction to the distribution of malicious programs. Besides, that would prevent illegal access to [hacking of?] computer information. > > At the same time Levin believes that the system of information control in the country "leaves much to be desired". He explains that "International tension, technologization and internalization of delinquency[?] make us put serious additional funds into military forces and law enforcement agencies. This is completely logical and justified, but for some reason the system of information control is [not in this series/not like this] yet." > > Levin mentioned that while Roscomnadzor (Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications) is successfully solving problems within its powers/limits, "it is obvious that it lacks people (staff units) and resources". ---------- https://vk.com/liga?w=wall-26121341_9052 Summary: Denis Davydov, Executive Director of the "League of Safe Internet" attacks Tor and its use in leading 'political struggle' English translation: > #anonymizers #tor #leagueOfSafeInternet > > In continuation of the theme of anonymizers > > League of Safe Internet: "Anonymous networks are used primarily to commit crimes" > > "We strongly support the idea of limiting Russia's access to anonymous networks, including Tor. "Invisible" Internet has made it possible for criminals of all stripes to hide their intentions from the state and use it to commit crimes: to acquire drugs and weapons, to distribute child pornography, to trade in human beings, including sex slaves, and to lead a political struggle. Do not forget that Tor is an American development and is used as well by the US intelligence agencies to expand the hegemony of the United States all around the world: agents and collaborators of the US State Department are engaged in illegal activities against countries while remaining anonymous to the authorities of that country. > > This is a very serious problem and it is bad that our government distanced itself from it and does not deal with it. > > I am convinced that the restriction on the use of anonymous networks will have a positive impact on us in every sense, will increase the trust of users to the network [Internet], and people will use it more actively and openly. This will lead to a specific economic effect and benefit to the state,"- the Executive Director of the League of Safe Internet Denis Davydov.

1 1

lab-in-a-box
by brian carroll 13 Feb '15

13 Feb '15

(quantifying and real-time activity auditing in-office) Lab-in-a-box takes aim at doctors' computer activity They call it "the Lab-in-a-Box." According to Nadir Weibel, a research scientist in the Computer Science and Engineering (CSE) department at the University of California, San Diego, inside the box are assorted sensors and software designed to monitor a doctor's office, particularly during consultations with patients. The goal is to analyze the physician's behavior and better understand the dynamics of the interactions of the doctor with the electronic medical records and the patients in front of them. The eventual goal is to provide useful input on how to run the medical practice more efficiently. Read more at: http://phys.org/news/2015-02-lab-in-a-box-aim-doctors.html

2 1

Fwd: Learning from dpr mistakes
by Travis Biehn 11 Feb '15

11 Feb '15

+ cypherpunks http://en.wikipedia.org/wiki/TRESOR - Keys are stored in debug or SSE registers and never leave the CPU. Use of AES-NI gives you solid performance. [side-channel DPA/timing etc vulnerable, though :(] That + trusted boot + dm-verity & FDE. Delicious. [Add Xen bare-metal & qubes-esque setup.] I've never seen TRESOR work, that might be a fun side-project for someone. -Travis On Tue, Feb 10, 2015 at 11:00 PM, grarpamp <grarpamp(a)gmail.com> wrote: > > But yeah, monitoring the environment is a solid idea, as is CPU <-> RAM > > encrypted pipeline. > > Someone was talking about this before, maybe in context of VM's. > Yet it really only works if after cold boot the key held in core for those > address segments luckily happens to be among the nonrecoverable > bits of ram. Who has researched those odds? Though defense in depth > is always good. > > Another way is to introduce a simple XOR hardware mask between > the cpu and ram, keyed via some external token, wrist fob, etc. > Unlikely computer makers respond to little demand for that. And > like AMT you certainly don't want it in your "Intel" chipset. > > Today you might be able to patch a kernel to switch over post bootloader > and consider its address space to now be that provided by an external > block device (sata/usb), which could then be such an encrypted mini > pluggable in the open hardware spirit of the usb RNG devices. It is the > ram, so you don't need a long term key there, random generated per boot > use is fine. Then you have moved keying issues to a smaller, manageable, > quickly blackenable device, like crushing its silicon with a thumbpress. > > >> 1) program to notice his magic bracelet is not near > >> 2) program to notice that vid cam is not a head but a chaotic scene > > Oh noes, my user's fitbit indicates ballistic heartrate / excess > g forces... blacken keys!... :-) > > Support more drunken ideas, btc: 1k2VQNW47wJDmsLCd2xkSjY28twKRah63 > -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn> -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

2 2

Fwd: [guardian-dev] Piñata server intrusion bounty
by grarpamp 11 Feb '15

11 Feb '15

---------- Forwarded message ---------- From: Patrick Connolly <patrick.c.connolly(a)gmail.com> Date: Tue, Feb 10, 2015 at 1:38 PM Subject: [guardian-dev] Piñata server intrusion bounty To: Guardian Dev <guardian-dev(a)lists.mayfirst.org> https://news.ycombinator.com/item?id=9027743 Would this be an interesting thing to put on a duplicate (...or production?) system and publicize? Might be an interesting practise for creating a form of canary, especially for projects that perhaps can't afford full and constant audits. Patrick -------------------------------------------- Q: Why is this email [hopefully] five sentences or less? | A: http://five.sentenc.es NOTE that my incoming emails are delayed from arriving in my inbox until 9am daily. If you need to reach me sooner, please use other means of getting in touch. #slowwebmovement _______________________________________________ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To unsubscribe, email: guardian-dev-unsubscribe(a)lists.mayfirst.org

3 3