- cypherpunks - lists.cpunks.org

Latest Belarusian censorship law & censorship actions
by Anton Nesterov 22 Dec '14

22 Dec '14

Today President of Belarus signed a law which provides heavy regulation to freedom of speech. Basically, it makes any website media and forbids "information aimed at the propaganda of the war, extremist activities, or the calls for such activities, pornography, violence, cruelty, and any other informations which distribution can harm national interest of the Republic of Belarus, or forbidden by this law, or by any other legislative act of the Republic of Belarus". It also force owners of websites to moderate user-generated content. Any website which violate this will be blocked. Also the law forbids any media with more than 20% of foreign investors. The law was passed really fast, only on 17st it came info parliament, and today, 21st, it's already signed by president. Nobody ever heard that such law are coming, even in the rumors. The law will came into force on 1st January. Yesterday domain name onliner.by, which hosted Belarusian media portal, was seized. They moved to onliner.ru. Media portal 21.by was also blocked. Two days ago some media was blocked, including charter97.org (they was already blocked for years for some users), belaruspartisan.org, gazetaby.com, zautra.by, udf.by, naviny.by, belapan.com, belapan.by. Minister of Information Liliya Ananich asked media to use only official sources and write articles in the national interest of the country. Besides media censorship, there is some financial problems because of Russian financial crisis. So the govt blocked 13 online markets which posted prices in US dollars, also 3 websites (deal.by, migom.by, kufar.by) was warned as they had ads on goods with price in $. prokopovi.ch, p2p currency exchange, was also blocked. http://www.pravo.by/main.aspx?guid=12551&p0=H11400213&p1=1 — text of the law (Russian) http://www.belaruspartisan.org/politic/289548/ (Russian) http://belapan.by/archive/2014/12/21/748603/ (Russian) http://www.belaruspartisan.org/politic/289548/ (Russian) http://www.belaruspartisan.org/politic/290031/ (Russian) -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

6 5

Fwd: [tor-talk] Possible upcoming attempts to disable the Tor network
by coderman 21 Dec '14

21 Dec '14

---------- Forwarded message ---------- From: Roger Dingledine <arma(a)mit.edu> Date: Fri, 19 Dec 2014 17:19:05 -0500 Subject: [tor-talk] Possible upcoming attempts to disable the Tor network To: tor-talk(a)lists.torproject.org The Tor Project has learned that there may be an attempt to incapacitate our network in the next few days through the seizure of specialized servers in the network called directory authorities. (Directory authorities help Tor clients learn the list of relays that make up the Tor network.) We are taking steps now to ensure the safety of our users, and our system is already built to be redundant so that users maintain anonymity even if the network is attacked. Tor remains safe to use. https://blog.torproject.org/blog/possible-upcoming-attempts-disable-tor-net… --Roger -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

4 6

Re: [Cryptography] GHCQ Penetration of Belgacom
by grarpamp 20 Dec '14

20 Dec '14

On Sat, Dec 20, 2014 at 12:31 PM, hbaker1 <hbaker1(a)pipeline.com> wrote: >>From: dan(a)geer.org >> >> | I think it would be very hard to find a backdoor suggested by >> | Norm Hardy. Modify the CPU to detect when two specific floating >> | point numbers are multiplied. When they are, execute the next >> | instruction in privileged mode. >> >>It's my second-hand understanding that it would take perhaps 3,000 >>gates to implement intentional sensitivity to a pre-designed kill >>packet. The addition of 3,000 gates to any current chipset will >>never be found in current hardware, e.g., the iPhone 6 has two >>billion transistors on the system chip. >> >>Others more knowledgeable welcome to correct my understanding. > > So Intel&Apple have provided PRC with netlists for their processor > chips? > > Of course, PRC shouldn't believe them, unless they could also > manufacture their own chips from the netlists. It doesn't matter what a chipmaker provides and claims as truth today. Anyone, spy or not, anywhere in the chain from design to fab could insert anything, there are probably not enough internal control and validation programs in place to find it. And if something untrustworthy is sucessfully implanted or simply produced TOP SECRET approved, who on the outside is going to find it? No one publicly open, external, and disinterested is sampling these chips off the shelves and decapping them, or exhausting all possible input data against expected output, or has eyes in the fabs. Until the world has truly open fabs, you might as well assume it's game over. Similarly, we can't even get rid of default firmware passwords, baseband, bad crypto, closed source, vPro, and all the other examples of potentially backdoorish things possibly against the user... including NSA style spying and corporate datamining tagged with your name. Can you apply enough pressure to get rid of closed fabs, and the elements within governments and corporations that think up, perform and produce this kind of stuff?

1 0

Bitcoin networks surpasses 2^80 hashes per week
by Ryan Carboni 17 Dec '14

17 Dec '14

https://blockexplorer.com/q/hashestowin log(171833398380382098659*24*60*7)/log(2) Gives context to the obsolescence of 80-bit block ciphers (it only takes ten million dollars of dedicated hardware to crack an 80-bit cipher). And context to the NSA's design of Skipjack. Naturally even a 2^64 collision attack requires implausible amounts of storage, so properly designed hash functions should be secure for the indefinite future.

5 5

Re: [Cryptography] Toxic Combination
by Alfie John 15 Dec '14

15 Dec '14

On Mon, Dec 1, 2014, at 08:55 AM, Guido Witmond wrote: > I'm starting to consider the combination of current best practice with > server certificates and password to be a Toxic Combination. > > The general issue is twofold: > > People need to validate the authenticity of a site before typing in > their password; > > The password gets transmitted to the other party. And this is taken advantage of every day by phishing attacks. However although your solution of setting up DNSSEC and DANE is the _correct_ solution, it's just too complex and hard to get right for a lot of system admins so it's not going to get uptake - just look at how PGP is also the _correct solution_ for encrypting messages and yet has not had the uptake since 1991! I think a better solution would be something like implementing Digest Authentication (RFC 2069, but replacing MD5 with something like AES-256 and allow it to be upgradable) in the browser. The password field value would then be replaced with the value from the DA call and no secrets would be leaked. This solution would get way faster adoption. Alfie > Most people assume that if it looks like their bank and the address bar > is green then it should be safe. Regrettably, it’s not. Criminals obtain > valid certificates using stolen creditcards and passports. The true > method for authenticating a site requires verification of server > certificate fingerprints. And if you don’t know what that means, you > have to spot the spelling errors, the differences in layout and other > mistakes to detect the scammers. Good luck! > > The second part is just as problematic: The password must remain secret, > yet it must be transmitted to the other side to log in. > > This is the Toxic Combination. One failure to detect a scammer’s site > and the password is compromised. The scammers can do everything that you > can do with the password. > > > [promo] > > For more information, please see: > > http://eccentric-authentication.org/blog/2014/11/30/spot-the-differences.ht… > > http://eccentric-authentication.org/Usable-Security.pdf > > [/promo] -- Alfie John alfiej(a)fastmail.fm

3 2

Snowden ran a major 2 Gbps exit node named “TheSignal”
by Seth 15 Dec '14

15 Dec '14

This may be old news to some but I found it quite remarkable to discover today that prior to fleeing what I like to call "The United State", Ed Snowden apparently ran a major Tor exit node named "TheSignal". http://pando.com/2014/07/16/tor-spooks/ Furthermore, he helped to organize and throw a freakin' Crypto Party on Oahu (contacting and co-ordinating via email with Runa Sandvik using his legal name!!) about six months prior to bailing for Hong Kong. According to the same Pandodaily article he "was trying to get some of his buddies at “work” to set up additional Tor nodes…". Not exactly a shining example of good OpSec for someone who is also secretly gathering a trove of classified documents to leak.

5 5

tor : just keep lying
by Juan 13 Dec '14

13 Dec '14

http://pando.com/2014/12/09/clearing-the-air-around-tor/ " What makes Tor different from the usual thesaurus-full of government projects is that Tor is essentially a very elaborate math trick, using layers of math puzzles to create a network-within-the-network. That math is being implemented in front of a global audience of millions of sophisticated watchers. It is likely the most examined codebase in the world. It has been subjected to multiple public audits. The math, well known and widely standardized, will work for everyone, or it will not, whoever pays the bills." What a piece of dishonest garbage. Now it turns out that all software is 'math' so it either 'works' or not? All the usual problems with government funded activities magically go away because "it's math". Wow. The stupid is overwhelming. "millions of sophisticated watchers" LOL - I wonder how many people actually reviewed tor's source? 10? 50? Or maybe 0? The funny thing with these zealots is that they are way more brazen and full of shit than even the tor developers.

2 1

Re: [cryptome] Pretty Damning Stuff. Out of the Mouths of the CIA
by Александр 13 Dec '14

13 Dec '14

Doug says: " *Is that perhaps why the USA government hasn't signed up to any international human rights act...one wonders. Because there is a chance some of their leaders would be prosecuted for crimes against humanity? *So many Americans are complaining about why they are hated so much in the world. Perhaps it could be something to do with the way they treat other nations, races and religions and cultures? A look in their own back yard to see if there is anything dirty there, and clean it out? *Blacks, people of colour get killed willy-nilly, even kids. The Grand Jury sees no case to answer. Racism abounds, sexism rages, yet, those very same leading Americans want to teach the rest of the worlds citizens lessons on human rights and equality. * It is indeed the highest form of hypocrisy, and a great insult to the intelligence of most people who inhabit this planet"* ____________ *BRAVO!* It is very encouraging to hear such words from an English-speaking person. Because as soon as these words (the truth) said by some Russian / Chinese / Arab person, it is instantly gets up in a column of "propaganda" or "enemy of the state". *BRAVO for the courage to speak the truth.*

1 0

Re: GoldBug SF projects [was: Bittorrent Bleep]
by grarpamp 13 Dec '14

13 Dec '14

On Mon, Sep 22, 2014 at 3:12 AM, Bernd Stramm <bernd.stramm(a)gmail.com> wrote: > To the extent that linux versions of these projects are available, I put > them in the opensuse build system. > From there you can get RPMs, and a few DEBs, including the source versions. > OBS signs them. If I wanted to try Unix/OBS versions I would. And I might if these issues are ever resolved and they are picked up and looked at by more Unix's. > So quit whining I'm defending users who might be considering running the binaries you distribute. As far as I can tell, no one has ever been able to reproduce them from your sources. And you haven't posted sufficient details about your platform to make whatever compilation notes you posted worthwhile. "32 bit windows" could be anything. I also can't find OpenPGP signatures for the binaries or the sources that you distribute. Nor can I find a reply from you or "Mike Weber" or anyone else regarding all these issues. > If you use windows, it is your own fault. So if I use the source without blobs I'm safe, but if I use your windows binaries I'm rooted? Or should this mean that you know windows sucks but you're writing to it anyways, and perhaps you don't care much about the implementation quality there. Now because you're a member of GoldBug Messenger on SF... / http://lists.gnupg.org/pipermail/gnupg-users/2013-July/047137.html / "[Today ...] the EFF in conjunction with the Chaos Computer Club announced a / new secure Instant Messenger called: GoldBug.sf.net (http://goldbug.sf.net)" Are you suggesting that users ignore the falsehood you put in your announcements and just trust your software? (Is that what all those anonymous 5-star 1-review posts of GoldBug to mostly second and third class windows software aggregator sites are about... building trust? You can google for those.) Or are you saying that you somehow forgot to post your own project denial of Randolph / Thomas posting as if they were associated with your projects? Ok, well maybe you did forget that, so let's see who has control... Currently: http://sourceforge.net/projects/goldbug/ "Brought to you by: berndhs, mikeweber" ... and what they do with that control... / http://lists.gnupg.org/pipermail/gnupg-users/2013-July/047137.html This gnupg thread also shows two other witnesses to... / "a review on sourceforge which indicates that the CCC has no idea / of it" / "... I also note that about 30 minutes ago, a representative of the Chaos / Computer Club (CCC) posted a one-star review of GoldBug in which he said / that CCC had never heard of GoldBug, despite GoldBug claiming to be / associated with CCC. / / About five minutes ago the GoldBug project admin disabled reviews and / the one-star review is no longer visible. / / This kind of behavior on the part of the GoldBug project leaders is / deeply irresponsible. This, by itself, should persuade people to not / use it. Responsible programmers *welcome* criticism -- we don't / suppress it." Currently: http://sourceforge.net/projects/goldbug/reviews "This project does not allow reviews to be posted." Now of course back then "Mike Weber" may have been the only one in the SF GB project, plus the apparent, in my opinion, shills Thomas and Randolph. However, you are now also on the SF GB project since at least Oct 26 2013. https://web.archive.org/web/20131004145711/http://sourceforge.net/projects/… https://web.archive.org/web/20131026004244/http://sourceforge.net/projects/… So lets see if your project has improved its behaviour since pointed out by people on gnupg list in Jul 2013... no it hasn't. To wit: Your project just censored my post and turned on list moderation so that no one else can speak. Oopsie, footshot ;-) https://web.archive.org/web/20140922090221/http://sourceforge.net/p/goldbug… https://web.archive.org/web/20140922201304/http://sourceforge.net/p/goldbug… http://sourceforge.net/p/goldbug/mailman/goldbug-forum/ "1 message has been excluded from this view by a project administrator." 14 out of 15 posts. "Your mail to 'GoldBug-Forum' ... is being held ... Post to moderated list" So the question now begs, with you being fully aware, and perhaps even complicit... why do you remain associated with projects that have serious issues? If you choose to remain, you definitely need to get "Mike", and you, to post an answer on this stuff. And if you choose to leave, an exit statement from you would surely serve you well as a possible member of the FOSS/Suse community. > So quit whining As long as all these questions remain unanswered, I will not quit defending users, or the names of Tor, EFF, CCC. Last minute additions... # These two addresses are '550 user unknown' ... berndhs(a)users.sourceforge.net mikeweber(a)users.sourceforge.net # A story about one particular Michael Weber http://www.businessinsider.com/swiss-software-developer-bitcoin-2014-4 # Another email found spot-on and dooble - "Alexis Megas" - textbrowser(a)gmail.com, textfield@us... # They uncensored my post to their list (second in this thread), # but have not yet approved my first from this thread, or possibly # this third post. http://sourceforge.net/p/goldbug/mailman/goldbug-forum/ # I'm aware of no replies other than Bernd above. Maybe for Goldbug et al it's all about the cute puppies... / http://lists.gnupg.org/pipermail/gnupg-users/2013-July/047137.html / "Some net communities already call it the 'Neuland Messenger' due to / the Font Name of the Logo." Really, they do call it that? Well shoot your foot again, seems that phrase has no applicable google search results on the net other than your own announcement and a ... http://www.infodog.com/RESULTS/brdrsl.htm?evno=2000110102&bno=31800 "Bern"ese mountain show dog. You silly "novice bitches", hopefully the twitters will have their way with you and your apparently bogus projects too. https://twitter.com/GoldBugIM Bye bye.

4 8

Keith Alexander's IronNet Cybersecurity Comsec
by John Young 13 Dec '14

13 Dec '14

Recognize former (and current?) NSA officials, among 30, working for Keith Alexander's IronNet Cybersecurity, Inc. <http://t.co/JruGTeDTRQ>http://cryptome.org/2014/12/keith-alexander-comsec.htm http://ironnetcyber.com/

1 0