- cypherpunks - lists.cpunks.org

Tor users can be de-anonymised by analysing router information
by Snehan Kekre 16 Nov '14

16 Nov '14

3 2

they crushed Aaron because they could, they destroy lives across the globe because they can, my fellow frogs in the boiling pot, how much is too much?
by coderman 15 Nov '14

15 Nov '14

they crushed Aaron because they could, they destroy lives across the globe because they can, my fellow frogs in the boiling pot, how much is too much? --- http://www.aaronswartzday.org/john-perry-barlow-recalls-a-12-year-old-aaron… """ I’d been asked by the headmaster of Northshore Country Day to come and speak to the middle school, and, for some reason, there was this 10 or 11 year old that was in among the middle schoolers. And I spent the afternoon – this was a time when, I don’t think there were that many people who felt the way I did about this stuff. Most of them are in this room now. And I was promoting the idea that we could make a world where anybody anywhere could give his thirst for knowledge and his curiosity everything that it wanted to know. And *anybody* could know as much as any human being knew about any thing, in the future. He didn’t say much. He was extremely memorable, however. He was much younger. He was all eyes, and mind, and…spiritual radiance, in a way. And I scarcely saw him again. But years later… Last year, at one point, when I was with a bunch of copyright barons in Paris at the EG8, and they were all talking about how enforcement and education was gonna come out right, and it was gonna be just like the War on some Drugs. And I happened to be on a panel with these guys. I said “you know, you think you’ve won this thing, or you will win this thing. But the truth is that you’ve turned a whole generation into an electronic Hezbollah. And you will be dead when they are alive. And I was thinking of Aaron Swartz and it’s really very difficult for me to see that he is dead, and they are alive. But he is not dead, and they will be. """ --- i cried when Aaron died, i raged when Snowden leaked, yet now i am calm and dedicated. enough!

3 2

Fwd: [Cryptography] ISPs caught in STARTTLS downgrade attacks
by grarpamp 15 Nov '14

15 Nov '14

---------- Forwarded message ---------- From: Dave Horsfall <dave(a)horsfall.org> Date: Fri, Nov 14, 2014 at 12:47 AM Subject: Re: [Cryptography] ISPs caught in STARTTLS downgrade attacks To: Cryptography List <cryptography(a)metzdowd.com> On Thu, 13 Nov 2014, grarpamp wrote: > > that can provide the practical privacy of a paper letter in a paper > > envelope. > > No!, there is no privacy there whatsoever. > 1) All addressing/envelope info is recorded/imaged at the processing > facility, tracked, stored forever, and shared with adversaries. > 2) Users are similarly imaged and linked via payments at drop off > and pick up. > 3) It's not encrypted. > 4) The user has to trust untrustworthy entities with 1, 2 and 3. Funny you should say that; it seems Australia Post has come clean: http://www.smh.com.au/national/australia-post-data-shows-more-mail-being-ac… (You may need to be a subscriber) Australia Post data shows more mail being accessed by government agencies Australia Post disclosed confidential information to law enforcement, security and other government agencies more than 10,000 times in 2013-14, an increase of 25 per cent over the past four years. According to statistics released by the postal corporation, "specially protected" information, which includes information about letters and parcels and other private client information was provided to government agencies by Australia Post on 5635 occasions – more than twice the number four years ago. Federal government investigators accessing specially protected information include the Australian Federal Police, the Australian Crime Commission, the Department of Immigration and Border Protection, the Australian Customs Service, the Australian Taxation Office, Centrelink, Medicare and the Child Support Agency. Victorian and Queensland police as well as the NSW Crime Commission and the Western Australian Corruption and Crime Commission also received such private information. Postal information that is not "specially protected", including names and addresses on the outside of letters and parcels, was disclosed by Australia Post on another 4367 occasions. Government agencies accessing this postal "metadata" include the Australian Securities and Investments Commission, the Australian Communications and Media Authority, and the federal departments of agriculture, environment, defence, foreign affairs and trade, health and ageing. State police and anti-corruption agencies, state revenue offices, consumer affairs, workplace and environmental regulators as well as the RSPCA also accessed the information. An Australia Post spokesperson said the corporation only discloses information to authorised agencies "under a law of the Commonwealth, or for the enforcement of criminal law, or for enforcement of a law imposing a pecuniary penalty, or the protection of the public revenue". The spokesperson emphasised information is disclosed "only after the 'authorised agency' requesting the information from us establishes that the information is reasonably required for … lawful purposes". The total of 10,002 disclosures in 2013-14 was 5 per cent higher than in the previous year, despite a 4.8 per cent decline in the volume of letters delivered by Australia Post. Only 19 disclosures of postal information were made to the Australian Security Intelligence Organisation. This figure for 2013-14 is down from 31 disclosures in the previous year and is the lowest in a decade. Australia Post's statistics show ASIO's access to postal information peaked in 2005-06 and 2006-07, with 117 and 226 disclosures respectively, a period that covered major counter-terrorism investigations in Victoria and New South Wales. ASIO must obtain a warrant from the Attorney-General to seek any postal information from Australia Post. Although the 2013-14 disclosure statistics precede the recent surge in counter-terrorism operations focused on supporters of the so-called Islamic State, the figures do suggest that ASIO's investigations target quite small numbers of people. However, the Australia Post statistics also show that despite consistent declines in mail volume, confidential postal information is increasingly accessed by police, by government agencies enforcing laws that impose financial penalties and for "the protection of the public revenue". -- Dave Horsfall DTM (VK2KFU) "Bliss is a MacBook with a FreeBSD server." http://www.horsfall.org/spam.html (and check the home page whilst you're there) _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

RedPhone Removed from Google Play Store
by George W. Maschke 15 Nov '14

15 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Early today, 11 November 2014, Open Whisper Systems' RedPhone app was removed from the Google Play Store: https://play.google.com/store/apps/details?id=org.thoughtcrime.redphone By contrast, TextSecure remains available: https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms and Open Whisper Systems' iOS app, Signal, remains available: https://itunes.apple.com/us/app/signal-private-messenger/id874139669 Any ideas what may have happened? George Maschke PGP Public Key: 316A947C -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUYh6sAAoJEEYqwKuPDNWqjbMQAICkb6KOLQsnXlx8Fsb+7Z9j naSroIJxqODaPLJKkZm7K8DVHlG1xwFT6PLVLs6gof0Ux3QsxVOdPO4VOgZruCcg 4fhRpu9ecnJrkhn3l861kwb+1AqDpZmbZeJEDMOIv71lmwv1MbT1WL19Sih60yz1 V8lOL0vn2T4UPWZMlul0kVlEOEPWgIbNBC/XhVbgPXjSoMS30vXeWgrn78yO0lue N7IAFUxwmict/d/0gzL+7XXXbCgt2faMsp4bLb8OOpd6PDd1csysexpkJM4KYVo+ OUatjMPSYruOrqFg2cYFDnA+O+GcW6WC3wcNN9+1MdbILjuUdgLHIPGhsDvQTOqN gq743pjUpecjC5sU5A5066gztpg6PBhvUlkdwOWsBlJ4qEnPBntowq6SnFbS56Oq bkxgMT5cgPcZHt5nFbAUEktW4z8Ex6OofVlqSK8N/wUTWjar6tdYSn7dF2nNZNFp 5Qu8gcnGbUtrFl6g/dgtUa0g151poXcc1qXRj3FekL4jvXr/iy8HBGpNsP7aGwmi djT+Fhvv4CmX9ExOOhJjUZaxwbWb+t8hXQz3QRUkYw7RHwspGd5Bb9MStbnKWKOD zhWVjNU5sHeC+oTI0rqTWK3WeRiKofEmhDOBBMkua/BiOoZbXsxgSQ/2JxCUmLJ9 R/ipJzsmKfxsfteQiCrb =i/ph -----END PGP SIGNATURE-----

11 13

Free Data From Space Forever vs. GuerrillaNets
by grarpamp 15 Nov '14

15 Nov '14

On Fri, Nov 14, 2014 at 12:26 PM, Ted Smith <tedks(a)riseup.net> wrote: > It's "censorship-free" in the sense that a nation-state can't > effectively block their citizens from using Lantern. > > So, it's a censorship-free centralized distribution system, as opposed > to a censorship-proof decentralized publishing system like Freenet. > > And it's centralized, so as soon as the central authority (the > satellites) are compromised, the whole system is owned. > > IMO this is a neat first step -- it's not the whole way, but it's > getting there. Now we just need Freenet or similar on decentralized > microsats. The only thing you'll ever get from space is whatever whoever owns the satnet wants you to see. The idea that people are just going to be able to bounce their own unregulated networks off transponders for free as in freedom is ridiculous unless you own your cube and all means of its control. Hint: not going to happen, let alone at any reasonable price point. If its that freedom you want today, go spend $100 and wire/wifi your residence to two of your neighbors and run CJDNS, etc on top of it. Repeat until you cover the globe in an individually segment owned meshnet, anonymized and encrypted on top for censorship resistance. Use whichever layer you want therein, the clear or anon one. It is the strict individual ownership and private peering of individual sized components of the network that keeps you free from all realistic physical/legal controls. And self-reinforcing deployment of encryption and anonymity that gives you freedom to share whatever data and thoughts you want with others and others with you... beyond just what you and your two neighbors might like chatting about. The greater percent of any network you cede to groupthink, groupbuy, and groupcontrol the less freedom you have. Launching and running shit in space involves a lot of freedom robbing group*. Homework: Do the math on number of residences / land parcels in your country. See how $100 in wire/wifi and router ports from each of them compares to the cost for each to truly own their own sat and sat link. Figure in launches, electricity, replacement, adversary HERF/laser attacks on the sats, millions of individual sat nodes colliding with stuff, network redundancy achieved, stability and speed of local wire in the ground, etc. Even at $500 to $1000 worth of onetime or amortized costs I'd bet wire/wifi guerrilla nets still win.

1 0

Fwd: [Cryptography] FW: IAB Statement on Internet Confidentiality
by grarpamp 14 Nov '14

14 Nov '14

---------- Forwarded message ---------- From: Salz, Rich <rsalz(a)akamai.com> Date: Fri, Nov 14, 2014 at 8:46 AM Subject: [Cryptography] FW: IAB Statement on Internet Confidentiality To: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com> -----Original Message----- From: IAB Chair [mailto:iab-chair@iab.org] Sent: Friday, November 14, 2014 4:26 AM To: IETF Announce Cc: IAB; IETF Subject: IAB Statement on Internet Confidentiality Please find this statement issued by the IAB today. On behalf of the IAB, Russ Housley IAB Chair = = = = = = = = = = = = = IAB Statement on Internet Confidentiality In 1996, the IAB and IESG recognized that the growth of the Internet depended on users having confidence that the network would protect their private information. RFC 1984 documented this need. Since that time, we have seen evidence that the capabilities and activities of attackers are greater and more pervasive than previously known. The IAB now believes it is important for protocol designers, developers, and operators to make encryption the norm for Internet traffic. Encryption should be authenticated where possible, but even protocols providing confidentiality without authentication are useful in the face of pervasive surveillance as described in RFC 7258. Newly designed protocols should prefer encryption to cleartext operation. There may be exceptions to this default, but it is important to recognize that protocols do not operate in isolation. Information leaked by one protocol can be made part of a more substantial body of information by cross-correlation of traffic observation. There are protocols which may as a result require encryption on the Internet even when it would not be a requirement for that protocol operating in isolation. We recommend that encryption be deployed throughout the protocol stack since there is not a single place within the stack where all kinds of communication can be protected. The IAB urges protocol designers to design for confidential operation by default. We strongly encourage developers to include encryption in their implementations, and to make them encrypted by default. We similarly encourage network and service operators to deploy encryption where it is not yet deployed, and we urge firewall policy administrators to permit encrypted traffic. We believe that each of these changes will help restore the trust users must have in the Internet. We acknowledge that this will take time and trouble, though we believe recent successes in content delivery networks, messaging, and Internet application deployments demonstrate the feasibility of this migration. We also acknowledge that many network operations activities today, from traffic management and intrusion detection to spam prevention and policy enforcement, assume access to cleartext payload. For many of these activities there are no solutions yet, but the IAB will work with those affected to foster development of new approaches for these activities which allow us to move to an Internet where traffic is confidential by default. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

Re: https://facebookcorewwwi.onion/
by Snehan Kekre 14 Nov '14

14 Nov '14

1 0

List Administrivia: archive stripping
by grarpamp 14 Nov '14

14 Nov '14

Noticed the web archives are mangling 'string@string' type constructs found in the body of posts. This harms and alters whatever the author was saying, particularly for code-like constructs. Any spammers will simply subscribe to the list and parse out all such address-like things as they are posted in real time. So please disable this misguided mangling. Thanks. foo(a)example.com

2 1

Re: [Cryptography] ISPs caught in STARTTLS downgrade attacks
by grarpamp 14 Nov '14

14 Nov '14

On Thu, Nov 13, 2014 at 2:01 PM, Bear <bear(a)sonic.net> wrote: > End-to-end email encryption solutions such as PGP do not > protect crucial elements in the headers. Failure! > STARTTLS > ... can only be run by the parties that run the mail > servers. Failure! > Since most correspondents rely on mail servers operated > by their ISP's Failure! > (and most ISP's block customer mail servers as > non-negotiable policy in order to limit spam sending) Failure! > The plaintext of STARTTLS > email is normally visible to the sender's ISP and receiver's > ISP. Failure! > Unfortunately, the ISPs do not risk substantial losses from > failures of STARTTLS Failure! > and can subvert or fail to implement it > in ways not immediately visible to those who do. Failure! > Predictably > some have therefore been subverting or failing to implement > it. Win! (For them and their cronies that is.) Traditional mail providers love: a) Money b) Plaintext c) Control They have stakes in their own game, you are not a stakeholder, thus they are not your friends. In this world, your only friend is you. You need to thus: a) Donate to account agnostic infrastructures that you use b) Remain in control of all keying and encrypt everything c) Use a P2P model, retain control, no more 'accounts', accounts are control and privacy failures individualized just for you > I'm increasingly of the opinion that there is no protocol > that can be derived from SMTP and compatible with it The traditional email model as we know it is fucked. You CANNOT fix 'Email'. And anyone who claims they can is full of shit. The model is broken. You have to throw it out and create a new messaging model. > that > can provide the practical privacy of a paper letter in a > paper envelope. No!, there is no privacy there whatsoever. 1) All addressing/envelope info is recorded/imaged at the processing facility, tracked, stored forever, and shared with adversaries. 2) Users are similarly imaged and linked via payments at drop off and pick up. 3) It's not encrypted. 4) The user has to trust untrustworthy entities with 1, 2 and 3. That is abject failure! To even bring it up as supposedly being secure, even if only to compare models with grandma... is ludicrous. The post is secure by fiat, and these days the word of fiat isn't enough to buy the damn stamp. Even grandma will tell you that. > Sigh. One more round of "Internet Mail, Privacy Fail." You cannot fix Email. Period. The only real solution is messaging end user to end user over an anonymous encrypted P2P network. Here's a long thread on that you can read and start working towards: The next gen P2P secure email solution https://cpunks.org/pipermail/cypherpunks/2013-December/002638.html ... https://cpunks.org/pipermail/cypherpunks/2014-July/004900.html

1 0

Fwd: [Cryptography] "DarkHotel" APT routinely breaking RSA512
by grarpamp 13 Nov '14

13 Nov '14

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Mon, Nov 10, 2014 at 5:50 PM Subject: [Cryptography] "DarkHotel" APT routinely breaking RSA512 To: cryptography(a)metzdowd.com "The Darkhotel crew’s skillset allows it to launch interesting cryptographical attacks, for instance factoring 512 bit RSA keys" The keys are used to create bogus certificates, e.g., GTE CyberTrust Digisign Server iD (Enrich) flexicorp.jaring.my sha1/ RSA (512 bits) Expired 12/17/2008 12/17/2010 Equifax Secure eBusiness CA 1 Equifax Secure eBusiness CA 1 secure.hotelreykjavik.i s md5/RSA (512 bits) invalid Sig 2/27/2005 3/30/2007 http://www.net-security.org/secworld.php?id=17612 http://25zbkz3k00wn2tp5092n6di7b5k.wpengine.netdna-cdn.com/files/2014/11/da… _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

3 3