- cypherpunks - lists.cpunks.org

healthcare & wearables
by brian carroll 08 Feb '15

08 Feb '15

(who says assassination politics is not alive & well..) Industry professionals create framework for measuring HIT value http://www.fiercehealthit.com/story/industry-professionals-create-framework… "Healthcare professionals have created a framework for measuring health information technology with a goal of making "HIT evaluations more relevant to the current needs of the healthcare system," according to a paper published at the American Journal of Managed Care..."

1 0

OnionShare - what do you think about this piece of software?
by Александр 07 Feb '15

07 Feb '15

https://github.com/micahflee/onionshare https://onionshare.org/ Well, it's too "young", but it's OpenSource and the idea is good. any thoughts?

5 7

Confidant Mail binaries for TAILS and MacOS
by Mike Ingle 07 Feb '15

07 Feb '15

Confidant Mail 0.20 is available at http://www.confidantmail.org No major functional changes, but there are ready to run binaries for TAILS Live CD 1.2.3 and MacOS 10.9 Confidant Mail is an encrypted, and optionally Tor-anonymized, email system supporting large file transfers. Mike Ingle <mike(a)confidantmail.org> d2b89e6f95e72e26e0c917d02d1847dfecfcd0c2

1 0

Re: [tor-talk] Fwd: I Encourage Everyone, Right Here And Now, To Donate Money To His Three Main Security Programs, Which He Uses The Most!
by grarpamp 07 Feb '15

07 Feb '15

On Sat, Feb 7, 2015 at 2:52 AM, Lara <lara.tor(a)emails.veryspeedy.net> wrote: >> when2plus2is5(a)riseup.net: >> In addition, Facebook and the online payment processor Stripe each >> pledged to donate $50,000 a year to Koch’s project. Useful. > So Facebook is not that evil after all. But on balance, merely a political photo op. http://en.wikipedia.org/wiki/File:PRISM_Collection_Details.jpg http://en.wikipedia.org/wiki/File:Prism_slide_5.jpg http://news.sciencemag.org/social-sciences/2015/02/facebook-will-soon-be-ab… http://www.cracked.com/quick-fixes/5-terrifying-ways-google-facebook-are-us… http://www.businessinsider.com/10-reasons-to-delete-your-facebook-account-2… https://www.eff.org/deeplinks/2010/04/facebook-timeline/ http://buzz.money.cnn.com/2014/07/01/facebook-evil-stock/ http://pitweston.com/facebookevil/

2 2

Calyx institute announces canarywatch.org web site
by Seth 07 Feb '15

07 Feb '15

"Warrant canaries rely upon the legal theory of compelled speech. Compelled speech happens when a person is forced by the government to make expressive statements they do not want to make. Fortunately, the First Amendment protects against compelled speech in most circumstances. In fact, we’re not aware of any case where a court has upheld compelled false speech. Thus, a service provider could argue that, when its statement about the legal process received is no longer true, it cannot be compelled to reissue the now false statement, and can, instead, remain silent. So far, no court has addressed this issue." https://canarywatch.org/

4 6

Re: Tox.im
by Markus Ottela 05 Feb '15

05 Feb '15

On 03.02.2015 20:38, rysiek wrote: >> yet the source of randomness and crypto implementation are not explained >> properly. The wiki talks about public keys and PFS without explaining >> the relation between the two. >> https://github.com/irungentoo/toxcore/blob/master/docs/updates/Crypto.md > ACK. So, the PDF I linked to goes a *bit* further (just a wee bit). Go > have a > look at the "Crypto" section: > https://jenkins.libtoxcore.so/job/Technical_Report/lastSuccessfulBuild/arti… > > > So, at least not a "we hold your keys -- FOR SAFETY!!1!" kind of > snakeooil. > Half of an "AOK" from me here. > Just because it could be worse doesn't mean it couldn't be better. Thanks for the whitepaper, I'll have a look when I've the time. >> *5. There is no threat model* >> "/With the rise of government monitoring programs/" implies it's >> designed to be secure against state surveillance. >> "Tox does not cloak IP addresses when communicating with other users" >> In disclaimer it is also just stated that >> "/Tox prevents message contents from being read or altered by third >> parties, or anyone else other than the intended recipient/", yet it >> doesn't even bother to evaluate the system against HSAs or MSAs. > True. One has to consider their own threat model and assess if Tox is the > answer. Tox does *not* provide anonymity, it at least *tries* to > provide OTR- > like features (encryption, integrity, etc.). > IIRC the DH signing keys are bound the the account ID. Appelbaum recommended in his 31c3 talk 'Reconstructing Narratives' that users rotate their OTR keys often and verify the hash using off-band channel. I'm not sure it's a convenient thing users have to re-add their contacts every time the DH signing key needs to be refreshed. It's sort of good thing users are immediately using the public signing key (Tox ID) but the issue is, while the Tox ID doesn't have to be secret, it must be authentic: so users unaware of this can be subjected to MITM attack. >> *7. Neglects general sad state of host security * >> > Well, yes, and my beef with Tox is also that the private keys do not > require a > passpharse to unlock. So that's a no-no in my book. This only changes the type of attack: a keylogger has to be used along the private key exfiltration tool. > Still, this doesn't look like snakeoil; rather like a good idea with > not-so- > stellar execution, which *might* get better. > > Am I missing anything? > I would argue the current OTR/PGP/ZRTP implementation has limited lifespan regardless of execution, given the fact intelligence community is expanding end-point exploitation to mass surveillance levels: methodology is changing, not the scale: https://www.youtube.com/watch?v=FScSpFZjFf0&t=37m35s There's a lot of misconception on 0-days being expensive 'one-time-hacks' that must be used only when necessary. How many anti-virus programs detect and report these? What percentage of users are running some sort of IDS? How many users assume sudden system crash is due to malfunctioning exploit/payload? A 0-day is more like a master key for given OS with average lifespan of 300 days ( http://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf ) > Could we have a *separate* thread for it? I'm really interested in > having a > more in-depth discussion of Tox and this could potentially hi-jack this > thread. Much obliged. > I agree it should be separate. I tried to keep that section short and the intention was to provide contrast and show each of these can be addressed simultaneously.

8 20

Re: Pixel Dust Is Futile like FOIPA
by coderman 05 Feb '15

05 Feb '15

On 2/5/15, John Young <jya(a)pipeline.com> wrote: > Peter Gutmann's pixel dust protection of privacy works as > an update for faith in elaborately futile shenanigans to evade > and to nab evaders inherently implanted in fetuses then re-implanted > in corpses: dust to dust... speaking of pixel dust futility, US Marshals sent back a tracking pixel nope, need vetting. ''' We sent you a form to have you certify your identification. You have not replied to this certification. We also ask you to clarify the information you were seeking as you were unclear in your request. See highlighted portion of our email below. << insert honeytoken >> '''' - https://muckrock.s3.amazonaws.com/foia_files/WRD000_630.jpg [ or was it muckrock failing protectively? or both? or one as cover for the latter? ... *grin* ] --- request to DHS rejected on specificity grounds, cycle continues, , hey John, want to file FOIPAs through MuckRock like the fucking mad you are? :P

1 1

Pixel Dust Is Futile
by John Young 05 Feb '15

05 Feb '15

Peter Gutmann's pixel dust protection of privacy works as an update for faith in elaborately futile shenanigans to evade and to nab evaders inherently implanted in fetuses then re-implanted in corpses: dust to dust. Logs are as deceptive and who, what and how they log. Machine designers and sysadmins artfully possessive documentaries inherently evasive and capturing. At 12:04 AM 2/5/2015, coderman wrote: >On 2/4/15, John Young <jya(a)pipeline.com> wrote: > > Darknet is hardly dark, or no more than Tor anonymizes, > > ... > >true; perhaps best quantified as: "no ISP asshattery". > but fails like all earth human technology in face of capable attacker >with significant resources. > >[ specifically, onion overlay avoids TCP RST, DNS redir, local network >ARP poisoning, IPv4/IPv6 BGP route jacking, transport privacy and >authenticity** attacks (rewrite proxy) ] > >** key management, someone has to do it. and it is always cumbersome... > >but that is nary a sliver in the sky of surface exposed, in typical >"rich web service" context, full of javascript and media handlers and >plug-ins, oh my! > > >tell us John, do your server logs show mostly complete or incomplete >downloads of Cfour? :P

1 0

REAL-ID Internet Access Coming Soon
by grarpamp 05 Feb '15

05 Feb '15

http://www.pcmag.com/article2/0,2817,2476275,00.asp Do not underestimate the precedence of the Chinese, Facebook and the rumblings in the UK/US/etc. Code all you want, but unless you start acting now in realworld politics to prevent this type of stuff (ID/names, anti-crypto, etc), you will very soon be kissing any rights to freedom and self managed privacy you now enjoy on the internet goodbye forever. Grabbers gonna grab and you'll be sorry. Don't try to claim people didn't warn you (you'll be censored by then anyways).

2 1

Re: Tox.im
by Ryan Carboni 05 Feb '15

05 Feb '15

In an enemy of the state scenario, don't think any amount of OPSEC will help you. Unless you literally live in a cave without running water or electricity. Personally: don't trust anything you can't program yourself, don't trust anything you wouldn't understand

2 1