- cypherpunks - lists.cpunks.org

Re: full year 2014 corpus
by coderman 03 Jan '15

03 Jan '15

> ... > "This is a trap, witting and unwitting. > Do not use it or use at own risk. > Source and this host is out to pwon and phuck you in complicity > with global Internet authorities. > > Signed Batshit Cryptome and Host, > ^H^H^H^H Dec 2014 it is: 47G, 63504 files, sig attached. https://peertech.org/files/fy2014lst.txt hidden service distribution to begin soon. we'll be collecting and reporting on performance results obtained. e.g. https://bugs.torproject.org/8902

1 0

Re: [Cryptography] New Encryption Standard of the Russian Federation GOST Grasshopper
by grarpamp 03 Jan '15

03 Jan '15

On Fri, Jan 2, 2015 at 1:39 PM, ianG <iang(a)iang.org> wrote: > On 2/01/2015 11:37 am, Eric Filiol wrote: >> The Russian Federation has recently published (in Russian only) the >> tchnical description of its new Encryption Standard. >> I have translated the document into English and implemented this >> algorithm in C (under GPLv3). >> http://cvo-lab.blogspot.fr/2015/01/the-new-gost-standard-from-russian.html > > *Interesting* and it would be very interesting to hear what the real > cryptographers think of the Russian cryptographer's invention! Good work! So there are no real Russian cryptos? Umm. > fair and open competition) did the net voluntarily swing to AES. The competition was part of the swing, so was govt's saying AES(256) was good for TOP SECRET (not that they use it over their own suites), so was it's speed/hardware/simplicity. > What do people say? Should GOST be supported in SSL? Is there any merit in > the "national government mandates" argument? There are govt laws for what the govt itself will only use. (Are you going to not sell to and profit from that govt?) There are govt laws for what the populace will only use. (Are you going to jail for breaking that ban, or will you bow?) There are paths between all the laws for what obediant users can use. And rebels will use whatever they want. If you personally use crap ciphers, that's your own problem. If you support (absent force of law) crap ciphers, or more than the best few in each class such that community has no time to properly analyze them all, that's a community problem. If you don't resist crap law, crap ciphers, or the spawning of endless new ciphers of the month just because, that's a community problem.

2 1

Snowden docs show none are originals of spies
by John Young 31 Dec '14

31 Dec '14

PDF properties of Snowden docs show none are originals of spies. Likely sanitized-redacted by Snowden/outlets, originals need open scrutiny.

2 1

Snowden Paywalled
by John Young 31 Dec '14

31 Dec '14

Free: 577,131 documents (millions of pages) informing public debate: https://www.documentcloud.org/public/search/ Paywalled: Snowden: 3,361 pp of 58K-1.7M files: http://cryptome.org/2013/11/snowden-tally.htm

2 1

Over 80 Percent of Dark-Web Visits Relate to Pedophilia, Study Finds
by Jordi Salvia 31 Dec '14

31 Dec '14

http://www.wired.com/2014/12/80-percent-dark-web-visits-relate-pedophilia-s… *---Jordi Salvia Cuadras* Vilafranca del Penedès *XMPP: *jsalvia(a)jabber.ccc.de <jsalvia(a)riseup.net> *PGP Key:* 0xBF9E5208

2 1

<JYA> Hash this motherfucker, said math to germ.
by coderman 31 Dec '14

31 Dec '14

On 12/29/14, John Young <jya(a)pipeline.com> wrote: > From discussion on these lists and elsewhere tampering with > data can, does, occur at every software and hardware hand-off, > with each self-serving iteration having hidden and vulnerable hardware > and software undisclosed malignity, no matter the security ostentatiously > applied said another way: there are risks known, and known unknown, and unknown unknown, in such a calculated cache - digital and present harm alike and unto the soul-deep sickness a dragon Smaug, imbued as dark greed, unto sea of coin and wealth unseen in any other age... the risk visible, or not. fathomable, or not. but risk all the same. --- "This is a trap, witting and unwitting. Do not use it or use at own risk. Source and this host is out to pwon and phuck you in complicity with global Internet authorities. Signed Batshit Cryptome and Host, 9 July 2014, 12:16ET." - https://cpunks.org//pipermail/cypherpunks/2014-July/005020.html still true, as always! ... as practical matter, content in such an archive is more actionable in a criminal or civil sense, in some locales, simply by nature of the contention around the content. or loaded with malware. or honeytoken to the void, or ruse of attention sink, or misleading intentionally compartment of confusion, or generator markov awry, or ... --- FY2014 corpora is coming, like cryptome-jul2014 reply to receive early distribution. - cryptome, web, other selected volumes - sha256 short sums, selected signatures - annotated search-able formats, where available - coder's annotations and subsets [to explain later] - Xapian stores by domain for custom aggregation or scope

2 1

Re: 78716A
by Badbiosvictim 30 Dec '14

30 Dec '14

Glad to hear there is legal assistance and a database without being charged attorney hourly fees. I will sign up with MuckRock. >From: Gregory Foster <gfoster(a)entersection.org> >Consider using MuckRock to file your FOIA request, track the response >schedule, and automatically post responsive documents publicly: >https://www.muckrock.com/agency/united-states-of-america-10/national-securi… > >You can review successful requests to the NSA to discern ways to >encourage timely responses, or use them as templates. The MuckRock >folks are doing important work to provide an environment for FOIA >requestors to avoid duplicative efforts, automate the tedium, and >create >a powerful new community. You can follow interesting requests to be >notified when there are status changes and get the docs immediately. > >gf

1 0

List Administrivia
by grarpamp 30 Dec '14

30 Dec '14

I believe google may be offering to transmit a better combination than RC4-SHA. Please check configs on your receive end. Received: from antiproton.jfet.org (antiproton.jfet.org. [209.141.47.85]) by mx.google.com with ESMTPS id bar (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128) 30 Dec 2014 Received: from google.com (google.com [a.b.c.d]) by antiproton.jfet.org (8.14.4/8.14.4/Debian-4.1) with ESMTP id foo (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <cypherpunks(a)cpunks.org> 30 Dec 2014

2 1

Re: [tor-dev] Hidden service policies
by grarpamp 30 Dec '14

30 Dec '14

I've blocked Mike's known nodes from my configs as I simply do not agree with his apparent ethos in this regard. That being themes of censorship, policing, etc. It's better individuals decide for themselves, or upon peer input, than upon hard forms of tracking prevail. There is a lot of oppurtunity and in fact effecting the desired outcomes in permitting such freedoms. But only misunderstanding and debilitating hatred and lack of progress of society in such proposed controls as Mike hints at from time to time. In example via forum, the power of interpretation is upon the consumer, and is received by the publisher. There is feedback there such that the Mike's of the world need not be entertained.

1 0

Fwd: 78716A
by Ryan Carboni 30 Dec '14

30 Dec '14

Common Americans are no longer considered worth protecting as part of national security. ----------- Mr. Carboni, Thank you for providing the information below. We have conducted an initial search within the organization that is most likely to hold records. That organization advised that the request, as worded, is overly broad. Querying any of our organizations would likely result in the same response. The phrase “malware transmitted through USB firmware” is overly broad, such that any of our internal organizations would not be able to determine which files to search or be able to conduct a search with a reasonable amount of effort. Terms such as “malware” or “firmware” may turn up in any number of NSA records and most likely would not be related to securing home networks. Furthermore, added search without a clarification of context and specific records sought, would incur significant fees which would be passed on to you as an “all other” requester. A large facet of the NSA/CSS mission is to protect National Security (i.e. government, DoD, Industry partners) information systems. In doing so, this Agency provides guidance on Information Assurance security solutions to our Industry and Government customers regarding risk, vulnerabilities, mitigations, and threats. While it is not part of our mission to provide guidance on securing home networks, we may occasionally post information on our website as you may recall from our letter. Our Information Assurance Directorate (IAD) has provided some information to the public that may be of interest to you. Here are some additional links that you may peruse: https://www.nsa.gov/ia/mitigation_guidance/index.shtml https://www.nsa.gov/public_info/press_room/2014/nsa_seal_scam_alert.shtml (this is a recent article the does provides a link regarding malware) https://www.nsa.gov/ia/index.shtml The last paragraph provides a video link under “IAD's Latest Security Guide Helps Customers Protect Home Networks,” and there is also a fact sheet titled “Best Practices for Keeping Your Home Network Secure.” Since the information you appear to be requesting (protecting home networks) does not fall under the purview of NSA/CSS missions, continued search of our files would not be productive. Your request will be administratively closed as an improper FOIA. If, after reviewing the information on our website, you wish to submit a FOIA request on similar topic(s), please provide enough detail to allow for an accurate and focused search. Regards, Cindy B NSA/CSS FOIA Requester Service Center (301)688-6527

3 3