- cypherpunks - lists.cpunks.org

Sign of New Order: US police kill boy, 12, carrying replica gun
by Georgi Guninski 26 Nov '14

26 Nov '14

http://www.bbc.com/news/world-us-canada-30172433 A 12-year-old boy has died after being shot by police in the US city of Cleveland, after carrying what turned out to be a replica gun in a playground.

1 0

Re: [Cryptography] Blogpost: CITAS, a new FBI security program proposal
by grarpamp 25 Nov '14

25 Nov '14

> genuinely seems likely to support rather than subvert security Security is not bringing more people onto your net or with you as partners, let alone biased LE. Do you let cops sleep in your house to protect you? What about that little dimebag you like to toke on Fridays? Besides, if they want the service, corps don't need LE to do what they can already do together neutrally on their own, or by subscribing to equivalent commercial honeypot services. What is this, infraguard 2.0? Clipper? Dept of redundancy? Big brother? TIA? Also, latency/TTL detection of remote hosting.. Heads up to Tor people, and cpunks to carve it up further. On Mon, Nov 24, 2014 at 8:24 PM, Ray Dillinger <bear(a)sonic.net> wrote: > Note to list participants: check the CC line of the original message > before responding. We are aware that this list is always monitored, but > this time I have explicitly invoked monitoring and explicitly invite > response. Hello Agent Chesson; feel free to join the (list and) > discussion if you have something to add or correct. It's a moderated > and usually very polite list, although events in the last couple of > years have caused some resentment and a great deal of distrust here > toward American Three-Letter agencies. > > Brief: The FBI is proposing a security service to assist American > companies in achieving network security. It is called CITAS, for > "Computer Intrusion Threat Assessment System." It is not an active > program yet; My impression that it is the proposal and brainchild of > special agent John B. Chesson and that he is actively trying to raise > support for it both within the agency and among its potential clients. > > This is one of very few proposals I have seen from any US agency that > genuinely seems likely to support rather than subvert security, in the > strict sense of owners retaining control of the assets they own. It > does not require backdoors, it does not require keeping insecure > plaintext traffic on the network, and it does not propose to compel > participation. > > What it proposes is that companies who join the service allocate an IP > address on their company's subnet for the use of the FBI, and the FBI > can then set up a honeypot at that IP address. Routers and switches in > the company's DMZ would direct traffic to the honeypot just as though it > were a company machine, leaving no clues to the contrary in route traces > or DNS, but the traffic would tunnel over some other channel, probably a > VPN, to a location controlled by the FBI. > > The honeypot would be physically located at and controlled by an FBI > data center. This does not imply that the FBI gets any > "behind-the-firewall" view of a company's network; the company's > firewall can distrust the honeypot just as much as it distrusts unknown > IP addresses out in the wild. > > The FBI would monitor the honeypots in real time for threats and > attacks, and when any "significant" threat or breach is detected, share > the information immediately with the subscribing company. > > Less briefly: > http://dillingers.com/blog/2014/11/24/citas-threat-assessment-system/ ‎ > > This arrangement strikes me as likely to be highly effective in terms of > security, because the FBI could leverage manpower and monitoring effort > across a huge pool of honeypots truly indistinguishable to attackers > from genuine targets. Effort spent by an FBI agent to understand and > script a log checker for a new threat would instantly apply to thousands > of companies via the honeypots sharing software, where the equivalent > effort spent by anyone else takes weeks to months to achieve wide > adoption, and never achieves wide adoption until after it is redone for > the nth time by many open-source volunteers. > > This arrangement also strikes me as problematic in that it would also > allow the FBI to set up a huge pool of Tor, Gnutella, Bittorrent, etc, > nodes truly indistinguishable to users from genuine nodes run by people > who support anonymity, uncensored journalism, whistleblowers, and free > speech. The data would, of course, be shared across all the usual > law-enforcement, espionage, and security agencies of the US. Although to > be honest, these services are already so heavily monitored that there is > little left to lose. > > Although Agent Chesson, whose presentation I attended, did not mention > these other uses, I would expect widespread adoption of this system to > mean effectively the death of "anonymous" P2P services such as Tor, due > to the simple fact of most of the gateway nodes being FBI-operated > sockpuppets. While Tor or something like it remains the only way in > most of the world to use the Internet for uncensored journalism or > whistleblowing, the FBI cannot possibly ignore that as a channel it is > also used by criminals. > > There is also some risk to the companies involved in the existence of > machines which they do not control but which have addresses publicly on > record as belonging to that company's subnet. They could experience > adverse public perception if a honeypot became publicly known as > someplace where an unsavory or criminal activity were happening and its > address were traced back to the company's IP block. > > > Ray "Bear" Dillinger > > > > > _______________________________________________ > The cryptography mailing list > cryptography(a)metzdowd.com > http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: [tor-talk] Propsal for decentralization of the Tor network
by grarpamp 24 Nov '14

24 Nov '14

> prove decentralization creates vulnerability to a larger degree > than centralization Maybe the centralization issue should revolve around things other than such two sided math proofs should neither side win... 1) There's expectation that some TPO-like entity will blackball known bad nodes, a non-human distributed authority (be it DHT or otherwise) doesn't permit that. Which is actually a non issue because users can simply subscribe to whichever trusted blackball source they desire. Onionland may still be providing some of these bad node listing services. AFAIK, that's the only real service Tor authorities provide today. The rest is under the hood of the *only protocol* in (3) below. 2) The network simply cannot run if some or all of the nine authorities are taken offline. Even users passing around their descriptors file and continuing to run can't be done because the code doesn't support that. So the network dies. Tor right now is like the centralized 'illegal' filesharing traffic model ie: Napster... every single central sharing service that had human figureheads in control of the network got shutdown. When the heat comes to Tor, it will get shut down if its fixed human authorities can't stand the heat. There are not an endless number of figureheads, but there are an endless number of users. For which, as with DHT torrenting and bitcoin, the responsibility for those networks is so distributed that it's pointless to try taking them down. Phantom, I2P, and a number of others are also distributed and seem to be working fine as well. 3) Bitcoin and torrent also work as protoools because all users agree that the protocol is *the one and only true protocol*, they are at risk if they change, so a self maintaining gravity is both present and natural. If there are forks, they don't last because users figure it out and abandon them or at least stop until the network figures itself out. This is why Tor bootstrapping isn't an issue either... you're unlikely to bootstrap yourself into a bogus network for very long, especially if you do reasonable research in the network socialnet beforehand. Self host the repository, ship with signed recent descriptor and bad nodes subscription lists, bootstrap into that, and let network dynamics and user choice run from there. At least that's the model of some other networks. Tor is probably central today as a result of inheriting a central design model. Thereafter if not remaining so from simple gravity then from either: A) waiting for a chance to stand up with its authorities for the sake of proving out fundamental privacy/speech geopolitics. B) putting them in the position of standing as test fodder. C) trending nefarious. Tor is a US entity which has certain benefits and weaknesses. And the international support structure of (A) should be analyzed and stress tested to determine its strength bfore relying on it. All the while noting and incorporating similarities to the WL, Snowden, filesharing, and crypto battles, etc. Curiously, whenever all is said, it's still useful to have both centralized and decentralized networks surviving under pressure. Yet is centralization actually *required*, say to achieve something specific beyond that, or which cannot be modeled decentrally with some decision elements pushed out to the user.

1 0

Fed proposal for Virginia cellphone data sharing network
by Gregory Foster 23 Nov '14

23 Nov '14

United States Attorney’s Office in the Eastern District of Virginia (~2011) - "A Proposal for the Creation of the Hampton Roads Telephone Intercept Sharing Network (HRTISN)" by Investigative Analyst Paul B. Swartz: https://www.documentcloud.org/documents/1364622-hampton-roads-usatty.html via arstechnica (Nov 21) - "Feds proposed the secret phone database used by local Virginia cops" by @cfarivar: http://arstechnica.com/tech-policy/2014/11/feds-proposed-the-secret-phone-d… gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

Liars and "justice for all"
by Georgi Guninski 22 Nov '14

22 Nov '14

Saw this on local news, probably the search terms are "Ricky Jackson" + <something about justice> According to: https://www.themarshallproject.org/2014/11/21/the-corrections > In Ohio, Ricky Jackson and Wiley Bridgeman were freed hours > ago, 39 years after they were wrongfully convicted of murder > – during the Ford administration. ... > because the principal witness against them, a boy of 12 at the time, > now says he lied when he identified Jackson, Bridgeman, and a third > man as murderers. “Everything was a lie,” said the witness, Eddie > Vernon. “They were all lies.”

1 0

Top Obama Admin DOJ Official to Apple, Google: Encryption Will Lead to Dead Kids
by Zenaan Harkness 22 Nov '14

22 Nov '14

http://www.dailytech.com/Top+Obama+Admin+DOJ+Official+to+Apple+Google+Encry… Top Obama Admin DOJ Official to Apple, Google: Encryption Will Lead to Dead Kids Jason Mick (Blog) - November 20, 2014 12:34 PM Agency feels it's best to give up freedoms, privacy to "keep the kids safe", Apple and Google say "yea, right" According to a report in The Wall Street Journal, James Michael Cole, the Deputy Attorney General of the United States (DAG-US), last month met with high-ranking Apple, Inc. (AAPL) executives to discuss their plans to allows consumers to encrypt their personal data on their smartphones. During the meeting he expressed strong disdain for the company's privacy protections and lofted a wild argument that his critics complained was inflammatory hyperbole. I. "Won't Somebody, PLEASE Think of the Children!" The report states that DAG Cole, the second highest-ranking official at the U.S. Department of Justice, claimed that children would die if Apple carried out the scheme. James Cole Deputy AG James Cole claims encryption will result in children dying. [Image Source: WND] His argument reportedly boiled down to that law enforcement might be able to find details in a missing child case on a suspect's phone, but be stymied by encryption, leading to a delay in finding the child. Such a delay, he argued could allow a child to die. Apple executives weren't buying into the DOJ official's hypotheticals. The WSJ report states: The meeting last month ended in a standoff. Apple executives thought the dead-child scenario was inflammatory. They told the government officials law enforcement could obtain the same kind of information elsewhere, including from operators of telecommunications networks and from backup computers and other phones, according to the people who attended. Both Apple and Google Inc. (GOOG) in recent months adopted features that allow users to fully encrypt their pictures, video, messages, and other data on their mobile device. As mentioned above, while the data on the device is encrypted, data stored in the cloud by Apple or Google is still vulnerable to court ordered data grabs. Likewise, data stored locally on the user's PC associated with the device may be less secure, depending on their level of encryption on that computer. Both Apple and Google have been very cooperative with detecting and reporting child abuse material detected in their messaging and cloud storage services. In fact, they've been so proactive that they've actually come under fire from some users who claim the companies shouldn't be inspect user data for signs of child abuse. Android and iOS encryption Both Apple and Google have rejected requests by the federal government to remove encryption from their consumer smartphone platforms. [Image Source: Google/Apple] Ironically, even as some users criticize Google and Apple for "violating their privacy" by inspect the data users willingly give them, federal law enforcement agency are attacking on a polar opposite grounds, claiming Google and Apple aren't doing enough to assist law enforcement. Thus far the U.S. Federal Bureau of Investigation's director, James Brien Comey, Jr., has been the leading voice of criticism against smartphone encryption. In a recent interview, he admitted that the FBI had abused the public's trust in the past with investigations against civil rights activists and other abusive actions. And he admitted that his agency operates relatively non-transparently so the public has no real way of knowing if those kinds of abuses have stopped. But he argued that the public should take the FBI's word that it's since improved. FBI director FBI Director James Comey claims encryption allows users to break the law. He wants the privacy protection banned from America. [Image Source: AP] Director Comey argued that by giving users tools to protect their privacy, American tech firms would "allow people to place themselves beyond the law." Congress recently rejected Director Comey's calls for legislative action banning consumer encryption. They said the FBI Director's requests were out of touch with reality and would allow Americans to fall victim to criminals. The majority in both the House and Senate argued that banning encryption was overreaching and inappropriate. II. 1984 In the Real World, Three Decades Later This criticism was echoed by his colleague at Britain's Orwellian spy agency, the Government Communications Headquarters (GCHQ), recently condemned the privacy protections. In a recent op-ed in The Financial Times (UK), he wrote: [Google and Apple's smartphone platforms] have become the command-and-control networks of choice for terrorists and criminals, who find their services as transformational as the rest of us. The GCHQ works hand-in-hand with the U.S. National Security Agency (NSA) to spy on hundreds of millions of law abiding citizens in the U.S. and Britain, saddling taxpayers with annual costs in the tens of billions of dollars to finance this unprecedented police state. The NSA and GCHQ have reportedly worked together to sabotage encryption standards. While that expensive effort damages both countries' national security by creating vulnerabilities that can be exploited by criminals or hostile nation states, the intelligence agencies feel it is worth it, if citizens can be stripped of protections and monitored at all times. The DOJ, for its part, seemed to take a more ambiguous stance. Departing Attorney General Eric Holder in a recent speech seemed at times to praise the American tech leaders, and at other times to come close to echoing Director Comey's stern commentary. Behind closed doors, though, the Justice Department's comments were apparently less vague. Apple and Google show little signs of budging on the issue, though. At an October global technology conference sponsored by The Wall Street Journal, Apple CEO Timothy Cook stated: Look, if law enforcement wants something, they should go to the user and get it. It’s not for me to do that. American business leaders complain that the government's overreaching surveillance efforts are damaging their reputation, particularly overseas, where many regions are boycotting American tech products due to security concerns. III. AT&T Files Suit to Block "Enormous" Volume of Data Request Targeting Law-Abiding Americans Even at the telecom level, there's increasing pushback, as companies like AT&T, Inc. (T) believe that mass surveillance programs are damaging consumer confidence. AT&T on Monday filed an appeal seeking to stop the current volume of requests for customer data and phone records under the 2001 USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act). Obama spying Under the last two presidents, the federal government has used techniques borrowed from imperialist Britain to spy on hundreds of millions of law-abiding Americans. [Image Source: Reuters] Due to the secrecy provisions in the act, AT&T cannot say precisely how many requests it has received, but reportedly the NSA and other agencies are collecting data on hundreds of millions of Americans using PATRIOT Act general warrants issued by the FISA court. These general warrants are a wholly new development in the American legal system, that borrow from similar provisions the imperial British used in the mid-1700s in an attempt to suppress colonial freedoms. AT&T says these general warrants and the data grabs they order are poorly justified judicially using 1970s Supreme Court decision regarding landline telephones. They say those decisions "apply poorly" to the world of modern digital communications, a world in which many more Americans are connected to communications networks and a world in which data is far easier to grab in bulk. AT&T could only legally say that the volume of consumer request by the American federal government was "enormous". AT&T Data Wide [Image Source: AT&T/CNET] AT&T's bid to block the American government from spying on millions of law-abiding citizens will be heard by the U.S. Court of Appeals for the 11th Circuit, in Atlanta, Georgia. In the meantime, the conflict will continue to play out on a different level as smartphone platform providers battle their country's government over whether Americans have the right to privacy. Source: WSJ http://online.wsj.com/articles/apple-and-others-encrypt-phones-fueling-gove…

4 3

Fwd: [Cryptography] Why mobile and consumer ISPs shouldn't censor encryption or the net
by grarpamp 20 Nov '14

20 Nov '14

Thanks John, forwarding... ---------- Forwarded message ---------- From: John Gilmore <gnu(a)toad.com> Date: Wed, Nov 19, 2014 at 8:31 PM Subject: [Cryptography] Why mobile and consumer ISPs shouldn't censor encryption or the net To: Tom Ritter <tom(a)ritter.vg> Cc: John Levine <johnl(a)iecc.com>, cryptography <cryptography(a)metzdowd.com>, jays(a)panix.com > ...this was port 25 on Cricket > Wireless, a prepaid mobile subsidiary of AT&T, i.e., a consumer > network without static IP addresses or mail servers. > > http://arstechnica.com/tech-policy/2014/11/condemnation-mounts-against-isp-… > > Blocking port 25 on consumer networks to prevent outgoing spam, with > real mail submitted on port 587 with authentication, has been an ISP > best practice for over a decade. I want to explore two of the assumptions in the above, that seem to be decisive for some people in the debate: "mobile" and "consumer". The theory seems to be that in a "mobile" Internet provider (that is, one run by a cellphone company), more censorship is justifiable. And that in a "consumer" Internet provider, like one that sells residential DSL or cable service, more censorship is justifiable. In this theory, an uncensored Internet should only be available to end user nodes that are servers and backbone ISPs, because they can be trusted to handle it, and they have the bandwidth to deal with the traffic. Let's talk about "consumer" first. The Internet is a peer-to-peer network. That has always been its strength, and one of the big things that distinguished it from the "master/slave" networks that preceded it like IBM's RJE, SNA, public networks like Telenet and Tymnet, and early computer communication services like MCI Mail, CompuServe and The Source. The Internet started with every peer able to talk to every other peer, with no nodes relegated to mere "clients" or "consumers". TCP is designed to make a working connection even if both nodes simultaneously and spontaneously reach out to each other, as opposed to having a "server" side lying in wait and a "client" side initiating connections. New applications and protocols such as multicast, instant messaging, VoIP, video conferencing, distributed source code control systems like git, Mobile IP, BitTorrent, Kademlia, federated social networking, and many others, including the Web which was invented dozens of years after the Internet, depend on this peer-to-peer behavior. When address exhaustion and NAT threatened peer-to-peer since the 1990s, the network evolved to continue offering peer-to-peer support, including IPv6 as the big fix, plus UPNP, NAT Traversal, dynamic DNS, supernodes, and other NAT circumvention technologies. In a peer-to-peer network it doesn't work to designate some portions of the network as "consumers" or "clients" who don't get full access, and other portions of the network as "providers" or "servers" who do get full access. Servers can be placed anywhere in the network, and frequently are placed on "consumer" networks. For example, in the homes of engineers or entrepreneurs, in consumer Network Attached Storage boxes, in ethernet video cameras, and even in flying $500 quadcopters. Consumers (e.g. people) should have all the same rights on the network as providers (e.g. websites). Consumer devices (e.g. tablets) should have all the same rights on the network as provider devices (e.g. data center servers). A device's location on the network is not and should not be relevant. Many of the most transformative innovations have come from individual consumers like Bram Cohen or Linus Torvalds who created new protocols that run at the edge of the network (BitTorrent and git). Now let's talk about "mobile". The theory is that mobile networks somehow should get more authority to censor or block traffic, because they have less total bandwidth available, or because their endnodes are "only" cellphones, or for reasons like those. Those arguments are largely specious, too. First, cellphones have evolved into full blown pocket computers, and there are more of them in the world than there are desktop computers. If the broad social move from desktops to pocket computers means that their billions of users get fewer rights and capabilities than they had in the previous generation, there's something rotten at the heart of that theory. EFF was founded more than 20 years ago to counter exactly this kind of creeping removal of well accepted civil rights via technological change. Cellphone users should have all the same rights against censorship and rights to encrypt their transmissions, as desktop computer users and as server operators. Software that runs as a mobile "app" should have the same rights on the network as software that runs as a Linux desktop "package". And by the time when our cellphones shrink to run in our wristwatch, our eyeglasses, or in our bloodstreams, our always-on network should not deprive us of rights that we had back in the day when we had to unpack our computer from a bulky suitcase. Second, it is easy for "mobile" networks to provide connectivity to full blown desktop computers or servers. USB mobile dongles are readily available and cheap. Mobile-based WiFi hotspots are readily available and cheap. The endnodes that connect to such hotspots, or use those dongles, should get no worse censorship and encryption policies than when they connect to a hardwired WiFi hotspot or to an Ethernet cable. Third, telephone companies are now actively claiming that they cannot affordably provide wired communications services, so they are asking regulators to be able to withdraw wired services and offering ONLY "mobile" networks to their customers in entire regions. This got the most press coverage after East Coast floods destroyed wired infrastructure, but it is a covert nationwide strategy and every day a telco petitions a government somewhere to eliminate the telco's core requirement to provide wired service to every customer who wants it. So not only do "mobile" users in those regions become second-class customers, but EVERY user in those regions becomes a second class customer. If every user gets a more-censored Internet in this transition, we're back to the dystopia of technological evolution and telco manipulation destroying the valuable and important civil rights that we all once had. Fourth, let's examine the "low bandwidth" theory. In many places on the earth, 3G and 4G and 5G mobile bandwidth exceeds the readily available bandwidth from wired Internet providers. DSL lines only reach tens of thousands of feet from a central office, relegating rural home users to dialup modems or satellite or other wireless feeds. Yet mobile cellular networks in rural areas often cover large geographical areas that hold few subscribers. This means that each subscriber gets a correspondingly large share of the total available bandwidth of the cell site, often making mobile cellular the highest available end user bandwith network. Fifth, even where wired networks offer higher bandwidth than mobile, the absolute bandwidth offered on mobile networks today vastly exceeds the bandwidth that was available just a short time ago. The original ARPAnet's backbones were 56 kilobit/sec leased lines, as were the original high speed ISDN Internet connections offered in the 1990s. When the NSFnet took over from the ARPAnet, it ran on big 1500 kilobit (1.5 Megabit, T1) backbones. Almost every server in the mid-1990s had no better connection to the Internet. The NSFnet was later upgraded to a T3 (45 megabits) backbone, roughly the downstream speed of today's consumer cable modem -- but that was enough for the entire North American continent. Most initial Internet users were on 14.4 kilobit dialup modems, eventually rising to 56 kilobit dialup. When the telco monopolies were forced to allow entrepreneurs to change the signalling on the last-mile wire to your telco central office, ADSL lines that ran a whole megabit or more (in one direction) became cheaply available to consumers and ordinary businesses. So getting back to the "mobile" theory, if your server is perfectly happy on a 1.5 megabit connection, why should you should get your access censored, your encryption blocked, and your application choices limited, depending whether your connection is a T1 line or a "mobile" dongle? Sixth, after natural or man-made disasters, wired connectivity is often destroyed, flakey or unavailable. Mobile networks are much quicker to repair after a flood, war, or earthquake, and may not go down at all. For the resilience of our infrastructure, which includes Internet services and not just backbone connectivity, end users should be able to switch both their "clients" and their "servers" onto whatever networks are functioning, at any time. A company that runs its own mail server should not have mail delivery fail, or refuse encryption, because it was wise enough to provision itself with backup connectivity via a mobile network. If after a tornado you put your web server on port 80 on a mobile network while running the server on battery backup, the cellphone company should not censor it. In disasters the network has to be flexible, not rigid and coercive. All these theories about why it's OK to censor Internet access, block certain services based on the whim of the ISP, and prevent end users from encrypting their traffic, come at their root from the monopoly nature of the underlying access media. In the heyday of the Internet, before these monopolies learned how to manipulate the regulators to prevent it, the monopolies were prohibited by law from telling you what phone numbers you could call, what ISP you could dial into, what protocols you could run over that modem, or who in the rest of the world you could communicate with. The telco couldn't stop you from calling the Internet -- much as they dearly would have loved to -- because they were a common carrier. And if your ISP developed crazy ideas about censorship, you could just dial into another ISP who had policies that suited you -- or start your own ISP and attract customers who like having full rights and freedoms. I did exactly that in the 1990s, when the available ISPs told me that I as a "consumer" couldn't split down and share my net connection with anybody else. The heart of today's "network neutrality" issue is that by falsely conflating the underlying broadband access media with "the Internet", and then deciding to leave both free of regulation, the regulators have abandoned that prohibition on discrimination. The FCC now allows the regulated monopolists to decide who you can talk to and what you can say to them. The fix is not to regulate the Internet. The fix is to regulate the underlying broadband access media -- the phone wiring, cable wiring, fibers to your house or neighborhood, and wireless infrastructure -- while preventing the infrastructure companies from forcing you to choose a particular "Internet" provider over that access medium. Thus over your cable modem you could buy Internet access from any of a dozen providers; over your cellular phone you could buy Internet access from the same dozen. The signals would be carried over a different medium, but neither the cable company nor the cellphone company could dictate which ISP you must use or on what terms you must access the Internet. We see this problem again and again in different corners of different issues, including this "anti-spammers versus consumer privacy" issue, but it's really the same issue. The access providers don't want to be common carriers who are obliged to carry all traffic for everyone -- because there's more money in getting a government granted monopoly and then being able to selectively sell access to that region, piecemeal, to the highest bidders. Like Comcast deciding that it won't take Netflix's traffic unless Netflix pays extra. Like T-Mobile deciding that you can't access http://mpp.org from your phone (try it) because it publishes about the politics of drugs, and "drugs are bad". And like spam-weary ISPs deciding that you can't encrypt your email transmissions because it would make their particular choice of ineffective antispam measures even more ineffective. John Gilmore _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

2 1

Re: [Cryptography] FW: IAB Statement on Internet Confidentiality
by grarpamp 20 Nov '14

20 Nov '14

>>> IAB Statement on Internet Confidentiality >>> Encryption should be authenticated where possible, but even protocols >>> providing confidentiality without authentication are useful in the >>> face of pervasive surveillance as described in RFC 7258. >>> https://tools.ietf.org/html/rfc7258 >> Alex: >> On a more serious note, the IAB statement below opens up a whole >> can of worms. You can't [...] >> [... cants, buts, excuses, grandmas, future protocols and policy, >> stake making and preserving, wimps, legal, etc... on and on... >> ad nauseum] > Ian / Jay: > Wot? I encrypt all the time without dealing with legal issues. > ... > No more free lunches, no more rolling over and playing doggy. > ... > No, we need not negotiate with ourselves before building and deploying stuff. > https://www.fourmilab.ch/documents/digital-imprimatur/ Indeed. Many seem to be missing the hidden extension / meaning of whitewashed quasi-political statements like those of the IAB that are now coming from various entities, and it's a point that needs made directly, at least regarding one aspect of things... It's not anymore about 'should encrypt by default'... continuing to give yourselves the lazy fallback excuse of oppurtunistic crypto and waiting for someone else to do it. It's not anymore about asking your masters for permission to do what is not regulated today, or giving them seats and chance to muddle / dictate your protocols before they're developed / deployed. It's about 'must encrypt' and turning plaintext completely off NOW! It's about telling all the lazy oppurtunistic fiber tapping passive surveillors, (who are today breaking fundamental inalienable human rights not just regulations, and without asking first)... to FUCK OFF! This is not a time to play nice and compromise... it's war, one which they started against you. So deploy your crypto now, far and wide, and faster than the enemy can respond. Mass internet entrenchment has a winning history against subsequent fiat. We won the first crypto war, now it's time to win the second one. Flip the crypto switch, from off to on. Don't ask, don't tell, just do it. Mail providers and web services... turn plaintext off! Banks, schools, utilities, blogs, socialnets, OS distributions, user applications... the public facing, used by the public, whole lot of you... everyone, everywhere... just turn plaintext off! All plaintext transports over the internet... OFF! Even decentralized P2P applications such as chat / filesharing apps that wish no model using CA certs, can still enforce crypto by skipping cert checking under self-signed certs or using [EC]DHE style crypto session negotiation. There's no lack of capability or support among all these internet facing services and apps used by the general public anymore. Every OS / library can deal with TLS 1.0+ or key negotiation for that. And you don't need some grand crypto scheme that you all love to pontificate in endless circles about right now either. Just turn the damn plaintext OFF and tell everyone to go read the FAQ and update their end if they can't connect. Then worry about your pie in the sky later. It doesn't have to be perfect, all you need to do is shift the game from taking cheap passive global wire surveillance up the ass, to requiring more expensive targeted active attacks. Simply turning off the plaintext does that, it's a huge win! https://en.wikipedia.org/wiki/Transport_Layer_Security#Applications_and_ado… And while you're at it, set up a nonprofit CA foundation to issue free certs and get it added to the Mozilla and MS cert stores specifically for the purpose of accomplishing 'plaintext off'. CA's are useless profiteers who couldn't authenticate their own ass as customers anyways, and cert stores are uselessly bloated with both them and enemy entities... so just give the damn certs away to anyone who can publish a proof of ownership flag / TLS cert on the forward reference to their own services... simply to quiet self-signed warnings. Nice to see something like this just dropped as I write: https://letsencrypt.org/ Pick July 4 2015 as the day to disable plaintext, since by then everything worth anything will support TLS 1.2 / good negotiation parameters, and it's a fitting meme. And if you don't like that flag, hoist another one... https://en.wikipedia.org/wiki/International_Talk_Like_a_Pirate_Day Now quit reading, making excuses and waiting... the enemy will just stomp all over your flag. Go get started on your code, updates and crypto configs... you've got a flag day to make.

2 1

Re: [Cryptography] FW: IAB Statement on Internet Confidentiality
by grarpamp 19 Nov '14

19 Nov '14

On Tue, Nov 18, 2014 at 2:21 PM, Tom Mitchell <mitch(a)niftyegg.com> wrote: >> On a more serious note, the IAB statement below opens up a whole can of >> worms. >> >> 1. The vast bulk of the Internet protocols now and in the future already >> exist. How are we going to retrofit them or somehow deal with them? New >> secure protocols will be a tiny percentage of the installed base of insecure >> protocols. > > If the goal is too large nothing will happen. > > Pick one service (like mail) and design a protocol that > can be used between hosts. > > <simple-mind> > Mail is a good example because it is store and forward. > At a big service like Yahoo or Google there are many sites > and internal store and forward links could use the new protocol. > > At first key management might keep the new connections inside > a service. Later a pair like Yahoo and Google could exchange > keys then others. > ... Blah blah blah same old tired centralized intermediary smtp email services, lack of privacy/anonymity, and application of control/censorship. If the goal is not dreamily large enough and totally revolutionary, nothing will happen but regurgitated refits instead of replacements. Try setting the goal of P2P messaging over an encrypted anonymous P2P overlay network instead. Do you believe pigs can fly? I do. > All that is needed is a specific service and specific firewall rules that > current Cisco > and the like hardware can enforce and audit. More central censorship and control. Where's my DNA based onramp access and Clipper card again... must have left it in the tax machine.

1 0

Doing HTTPS everywhere in the .gov space
by Eric Mill 19 Nov '14

19 Nov '14

Hey, I wrote a piece today for my organization, 18F, about our HTTPS-everywhere policy for the .gov websites we build inside the US government: https://18f.gsa.gov/2014/11/13/why-we-use-https-in-every-gov-website-we-mak… I wanted to give this list some extra context, since I understand the US government is a big, complicated, freighted topic. Below is my *personal* attempt to describe my workplace and is not anything close to an official description or the voice of the government. 18F[1] is a team of ~70 people working as full time employees inside the US federal government. (The name comes from the street intersection -- 18th St & F St -- that its HQ is at in DC.) 18F as a unit was created around a year ago to be a competent, top class in-house technology team for the US federal government. A driving idea here is that the government shouldn't need to outsource its *entire* technical brain to contractors, and that government services can be simple and even beautiful. If you've noticed what's happened over the last few years in the UK at https://www.gov.uk by the Government Digital Service[2], 18F takes a lot of inspiration from them. 18F is housed inside the General Services Administration, an independent federal agency[3] that does as many different things as its name implies, from running all the buildings to housing the nation's data catalog at Data.gov. It's an "independent" federal agency in that it's not subject to the same level of direct executive and White House control that cabinet agencies are. It's the same kind of "independent" that lets the FCC potentially disagree with the President on net neutrality, for example. The team has people all over the country (it has a big SF office, for example), many of which have either never been in government before, or who came in after doing the Presidential Innovation Fellows[4] program. I joined 18F after working for 5 years on open data apps, infrastructure, and policy at the Sunlight Foundation[5], a non-profit in DC that pushes for open government. I had also done a fair amount of work around privacy, HTTPS, and ongoing judicial activity around surveillance. I get to continue doing all of that work in my personal capacity. I say this just to try to communicate that the 18F team has some very sincere people trying to make the US government work better for people all over the world, and to do right by technology in the process. We have substantial support and autonomy to make that happen. When it comes to HTTPS, the .gov surface area is absolutely enormous, and moving it helps move the whole Internet forward. Bringing the government in line with the rest of the web/security community (and being loud about it) is one of my big priorities at 18F, and so I wanted to share this here with you all. -- Eric [1] https://18f.gsa.gov/ [2] https://gds.blog.gov.uk/ [3] https://en.wikipedia.org/wiki/Independent_agencies_of_the_United_States_gov… [4] https://en.wikipedia.org/wiki/Presidential_Innovation_Fellows [5] https://sunlightfoundation.com/ -- konklone.com | @konklone <https://twitter.com/konklone>

9 22