- cypherpunks - lists.cpunks.org

Re: CITIZENFOUR
by tigrutigru＠gmail.com 24 Oct '14

24 Oct '14

Russian gov is not nice. Though it's kind of lucky that it has to do rather nice things to piss US gov off. Sent from my iPhone > On 25 Oct 2014, at 01:27, cypherpunks-request(a)cpunks.org wrote: > > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. CITIZENFOUR (Rich Jones) > 2. Re: Of Sealand, corp, and country [was: nation-state] (Juan) > 3. Re: CITIZENFOUR (John Young) > 4. Re: Of Sealand, corp, and country [was: nation-state] (Juan) > 5. Re: CITIZENFOUR (Colin Mahns) > 6. Re: Of Sealand, corp, and country [was: nation-state] > (Cathal Garvey) > 7. Re: CITIZENFOUR (Michael C. Toren) > 8. Re: Of Sealand, corp, and country [was: nation-state] (Juan) > 9. Re: CITIZENFOUR (odinn) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Oct 2014 11:58:22 -0700 > From: Rich Jones <rich(a)openwatch.net> > To: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> > Subject: CITIZENFOUR > Message-ID: > <CADJYzxL0-5oq9vmFe45YUbF_cYcBkUsxm+kdSNi0c6FvPBU6Ww(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Saw this last night - an obvious must-watch for all CPunks. I think it was > probably the most important documentary film of all time. As Roger Ebert > said, "it’s as if Daniel Ellsberg had a friend with a movie camera who > filmed his disclosure of the Pentagon Papers every step of the way. Or if > the Watergate burglars had taken along a filmmaker who shot their crimes > and the cover-up that followed. Except that the issues “Citizenfour” deals > with are, arguably, a thousand times more potent than Vietnam or > Watergate." Truly, this is the Snowden story we have been waiting for since > 2013. > > The main revelation of the film, however, is what an incredible boob Glenn > Greenwald is. I had some idea of this after seeing him give an extremely > disappointing talk earlier this year, but I don't think I quite understood > how useless this guy really is. He's constantly asking the wrong questions, > displays a technical ineptness (to the point of deliberate ignorance) that > obviously hampers the journalism, and at very step shows a very clear > desire to keep the document cache to himself for careerist purposes. At one > point Ewen MacAskill brings up the idea of there being a Wikileaks-esque > document explorer, and Ed says that this would be the best outcome for the > documents, and Greenwald quickly dismisses the idea to talk about his > publishing schedule. I still have immense respect for him, but I found it > very frustrating and quite cringey to watch him treat the whole event in > news-cycle terms, while everybody around him is obviously thinking in > historical context. For instance, there is a moment when they are prepping > for Ed's first on-camera interview and he asks the reporters how much > background he should give about himself, and they give different answers. > Poitras asks for as much detail as possible, and Greenwald basically says > that isn't important, just be short so we get a good soundbite. > > More importantly, I think the film also misses an opportunity to talk about > *power*. This is something Edward himself has addressed, but it isn't > really covered in Greenwald's reporting or books, and the only time it's > mentioned in the film is when Jacob Appelbaum, while speaking before a > European council of some sort, quite astutely comments that surveillance > and control are one and the same. I think the film should probably have > spent another hour or so investigating, naming and confronting those who > profit from that control. Other than a few choice C-SPAN snippets, the > enemy is completely faceless, which plays well for the pervading sense > paranoia which envelops the film, but also leaves many questions unasked. > Perhaps that's left as an exercise for the viewer, but I think the general > take-away message from both the reporting and to a slightly lesser extent > the film is that any "solution" will be token reform of policy and not > dismantlement of power structures. > > Also, very nice of the Russian government to let Ed have his girlfriend > back. I didn't know that had happened, and it gives a rather unexpected > happy ending to a film which otherwise made me want to cry desperately. > > Anyway, I'd be very interested to hear what you lot thought of it. (JY, you > should throw a torrent up ASAP! I'm sure people will be screenshotting and > analyzing all of the new document shots the film contains.) > > R >

1 0

CITIZENFOUR
by Rich Jones 24 Oct '14

24 Oct '14

Saw this last night - an obvious must-watch for all CPunks. I think it was probably the most important documentary film of all time. As Roger Ebert said, "it’s as if Daniel Ellsberg had a friend with a movie camera who filmed his disclosure of the Pentagon Papers every step of the way. Or if the Watergate burglars had taken along a filmmaker who shot their crimes and the cover-up that followed. Except that the issues “Citizenfour” deals with are, arguably, a thousand times more potent than Vietnam or Watergate." Truly, this is the Snowden story we have been waiting for since 2013. The main revelation of the film, however, is what an incredible boob Glenn Greenwald is. I had some idea of this after seeing him give an extremely disappointing talk earlier this year, but I don't think I quite understood how useless this guy really is. He's constantly asking the wrong questions, displays a technical ineptness (to the point of deliberate ignorance) that obviously hampers the journalism, and at very step shows a very clear desire to keep the document cache to himself for careerist purposes. At one point Ewen MacAskill brings up the idea of there being a Wikileaks-esque document explorer, and Ed says that this would be the best outcome for the documents, and Greenwald quickly dismisses the idea to talk about his publishing schedule. I still have immense respect for him, but I found it very frustrating and quite cringey to watch him treat the whole event in news-cycle terms, while everybody around him is obviously thinking in historical context. For instance, there is a moment when they are prepping for Ed's first on-camera interview and he asks the reporters how much background he should give about himself, and they give different answers. Poitras asks for as much detail as possible, and Greenwald basically says that isn't important, just be short so we get a good soundbite. More importantly, I think the film also misses an opportunity to talk about *power*. This is something Edward himself has addressed, but it isn't really covered in Greenwald's reporting or books, and the only time it's mentioned in the film is when Jacob Appelbaum, while speaking before a European council of some sort, quite astutely comments that surveillance and control are one and the same. I think the film should probably have spent another hour or so investigating, naming and confronting those who profit from that control. Other than a few choice C-SPAN snippets, the enemy is completely faceless, which plays well for the pervading sense paranoia which envelops the film, but also leaves many questions unasked. Perhaps that's left as an exercise for the viewer, but I think the general take-away message from both the reporting and to a slightly lesser extent the film is that any "solution" will be token reform of policy and not dismantlement of power structures. Also, very nice of the Russian government to let Ed have his girlfriend back. I didn't know that had happened, and it gives a rather unexpected happy ending to a film which otherwise made me want to cry desperately. Anyway, I'd be very interested to hear what you lot thought of it. (JY, you should throw a torrent up ASAP! I'm sure people will be screenshotting and analyzing all of the new document shots the film contains.) R

4 3

NSA Co-Chairs of Crypto Forum Research Group, Legitimacy of WebCrypto API in Doubt
by odinn 23 Oct '14

23 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 For those of you on this list who have been watching the progress of things relating to the W3C coordinated process for the WebCrypto API, you know that a lot of work and thought has gone into this and it is an impressive collaboration. But with the IETF CFRG (Crypto Forum Research Group) still being co-chaired by an agent of the NSA (n1), anything that passes through that organization must be questioned at this time. (In the unlikely event that the CFRG page is censored after this message is sent, I've included the names and e-mail addresses of the current co-chairs as part of this message as they currently appear on the CFRG's site, where their names and e-mail addresses have been sitting in full public view for a very long time (n2)). As some of you already know, people within the Crypto Forum Research Group have tried (so far unsuccessfully) since last year (n1, n2, n3) to remove the NSA Co-chair. It should not matter who the person is, but the issue is that having anyone who is in the employ of or affiliated with the NSA chair (or co-chair) a research group whose purpose it is to advise all IETF Working Groups, is highly problematic for reasons which now should be obvious to anyone reading this message. Currently the WebCrypto API is approaching its last call ~ it's in a process of being finalized. For those who are not sure what the WebCrypto API is, it's one of those things that is designed to basically help make ordinary webpages that you see work, and includes the definition of cryptographic primitives that make your internet go. That's a terrible description actually, but if you want a better or more comprehensive description of WebCrypto API in plain English, consider reading poulpita's blog (n4). It's also described at a W3C page as a "JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform these operations. Uses for this API range from user or service authentication, document or code signing, and the confidentiality and integrity of communications." (n5) But the WebCrypto API Doc process and, and indeed the legitimacy of the WebCrypto API itself, should be questioned and doubted, for the WebCrypto group has recently held off on including the widely-used curve25519 within NamedCurve dictionaries or as part of its extensibility and errata process, until the (NSA co-chaired) Crypto Forum Research Group gives W3C the go-ahead. For further information and confirmation on this, see (n6) below. If you are concerned about this, check out the message thread discussing attempts to remove the NSA co-chair (n3) and consider posting to the CFRG list (n7) about it once you subscribe. NSA affiliated persons need to be removed from groups that influence the direction of the entire web. I hope those who receive this message will organize to help make that happen. (n1) https://irtf.org/cfrg (n2) From CFRG's public webpage (n1) as of Oct. 20, 2014: "CFRG is chaired by Kevin Igoe (kmigoe(a)nsa.gov) Kenny Paterson (kenny.paterson(a)rhul.ac.uk) and Alexey Melnikov (alexey.melnikov(a)isode.com)" (n3) http://www.ietf.org/mail-archive/web/cfrg/current/msg03554.html (n4) http://poulpita.com/2014/08/28/w3c-web-crypto-whats-next/ (n5) https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html (n6) https://www.w3.org/Bugs/Public/show_bug.cgi?id=25839 (see in particular: comments 11, 12, 48, and 59 through 63 on that page) (n7) https://irtf.org/mailman/listinfo/cfrg - -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJURL5EAAoJEGxwq/inSG8CN6QH+wZK+J15RtA4PART46BJRuPf 6ikb/gncf1oIVqVhII1MZyni9Tz+l9fZxkEiPN7bEAZg9zEkm/UrJhpQGa+Q1Lna vNanGyLfnVGJjsA1AxXpBnBsxqm8uwbLQNtNhLdf/UnEk92aNFgvroxSWk62aGoh 3zpzwTMioe1OWyuWk2y3adx/0WTAP9YRuM3J6MKY+Qh+mJMZJmCsnal+Dw/gqjSn Nd5oYght6H+9Af4bwSq3Eh816ojHg6rmzgAIIyWLyeFQiSPHrZVdFXa1bYUeM2gW 8a1udtaRLfVf69IevOvbIc2RM8Lh+uAKXFk65jfpvh2TbJ6U8PP9BUR799XGfEY= =k9SP -----END PGP SIGNATURE-----

1 1

Digital security consultant willing to be based in LatAm?
by Bethany 22 Oct '14

22 Oct '14

Front Line Defenders (FLD) in partnership with Tactical Technology Collective (TTC) is working to expand capacity of Human Rights Defenders (HRDs) to manage risks associated with the use of digital communications. We would like to offer direct, on the ground support to HRDs with the help of a Digital Security Consultant (DSC) based in Latin America. FLD and TTC are seeking cooperation with a consultant for a contract finishing at the end of 2015 to help with digital security support for HRDs and HR organisations at risk in Latin America. The deadline for the applications is 9th November 2014. Read more: https://www.frontlinedefenders.org/node/27505 --- Front Line Defenders (FLD) y Tactical Technology Collective (TTC) están trabajando juntos para que defensores/as de derechos humanos (DDH) incrementen su capacidad para el manejo de riesgos asociados con las comunicaciones digitales. Nos gustaría ofrecer asistencia directa y en el terreno a los/as DDH a través de la asistencia de un Asesor en seguridad digital (ASD), con base en América Latina. FLD y TTC buscan trabajar en cooperación con un asesor, a través de un contrato hasta fines del 2015, para ayudar a brindar asistencia en seguridad digital para DDH y organizaciones de derechos humanos en riesgo en América Latina. La fecha tope para enviar las postulaciónes esta 9 de noviembre de 2014. Leer más: https://www.frontlinedefenders.org/es/node/27506

1 0

shot over the bow - BIS to control crypto exports anywhere (to ensure backdoor enabled?)
by coderman 20 Oct '14

20 Oct '14

http://www.theregister.co.uk/2014/10/17/intel_subsidiary_crypto_export_fine/ """ Wind River Systems exported its software to China, Hong Kong, Russia, Israel, South Africa, and South Korea. BIS [Bureau of Industry and Security] significantly mitigated what would have been a much larger fine because the company voluntarily disclosed the violations. We believe this to be the first penalty BIS has ever issued for the unlicensed export of encryption software that did not also involve comprehensively sanctioned countries (e.g., Cuba, Iran, North Korea, Sudan or Syria). This suggests a fundamental change in BIS’s treatment of violations of the encryption regulations. Historically, BIS has resolved voluntarily disclosed violations of the encryption regulations with a warning letter but no material consequence, and has shown itself unlikely to pursue such violations that were not disclosed. This fine dramatically increases the compliance stakes for software companies — a message that BIS seemed intent upon making in its announcement. """ fuck BIS!

2 1

Re: Corporate undercover nation-state agents
by Nicolas Bourbaki 20 Oct '14

20 Oct '14

It should be clear now, if not long ago, that the US Government is the silent occupier of the stateless generation. This is true no matter the protest the American technological industry may attempt present in response to this fact. In light of this "Balkanisation" should be seen as a marketing term thought up by US actors to prevent the rest of the world from noticing that their data, sitting in or traversing the US, has less rights than that of a Syrian refugee. On 11/10/2014 03:20, bluelotus(a)openmailbox.org wrote: > https://firstlook.org/theintercept/2014/10/10/core-secrets/ > > "But the briefing document suggests another category of employees—ones > who are secretly working for the NSA without anyone else being aware. > This kind of double game, in which the NSA works with and against its > corporate partners, already characterizes some of the agency’s work, in > which information or concessions that it desires are surreptitiously > acquired if corporations will not voluntarily comply. The reference to > “under cover” agents jumped out at two security experts who reviewed > the NSA documents for The Intercept. > > “That one bullet point, it’s really strange,” said Matthew Green, a > cryptographer at Johns Hopkins University. “I don’t know how to > interpret it.” He added that the cryptography community in America > would be surprised and upset if it were the case that “people are > inside [an American] company covertly communicating with NSA and they > are not known to the company or to their fellow employees.” > > The ACLU’s Soghoian said technology executives are already deeply > concerned about the prospect of clandestine agents on the payroll to > gain access to highly sensitive data, including encryption keys, that > could make the NSA’s work “a lot easier.” > > “As more and more communications become encrypted, the attraction for > intelligence agencies of stealing an encryption key becomes > irresistible,” he said. “It’s such a juicy target.” >

5 4

Fwd: [whispersystems] Warrant Canary - Gag order in place right now?
by coderman 19 Oct '14

19 Oct '14

---------- Forwarded message ---------- From: Moxie Marlinspike <moxie(a)thoughtcrime.org> Date: Thu, 16 Oct 2014 16:27:04 -0700 Subject: Re: [whispersystems] Warrant Canary - Gag order in place right now? To: whispersystems(a)lists.riseup.net On 10/16/2014 03:13 PM, Advocatus Diaboli wrote: > I've been watching the development of TextSecure and other OWS apps for > a while, and among other things wondered why there is no warrant canary. > > 20 Minutes ago, a comment was posted in the following issue - and > promptly deleted again 5 Minutes ago: As far as I can tell, nothing was deleted, you're just looking at the wrong issue: https://github.com/WhisperSystems/whispersystems.org/issues/34 > It has been deleted by either the author or an OWS administrator. It > stated that, unlike moxie says in the issue, the EFF's lawyers obviously > are of the opinion that warrant canarys do work: There's a huge difference between the EFF taking a public position on an untested legal concept and a lawyer providing council to a client. Of course the EFF is going to advocate them, their job is to take that position. Whether warrant canaries will work or not is not my area of expertise. However, I don't want to experiment with them for two reasons: 1) Lawyers who provide us council have told us it's very likely they won't work. I don't want to advertise something that could be interpreted as an assurance which is actually false if for some reason it ever came down to that. 2) It's not the hill I want to die on. We're not well positioned to push the state of the art in legal policy or to be a test case. It's not what we're good at, and honestly the point of our work is to make those kind of questions irrelevant by not having any data to provide. That's the envelope that we *are* interested in pushing. > If this would be the case, they should not to put up a warrant canary > (because it would be lying), and they would also not be able to explain > why they cannot publish a warrant canary (because that would violate the > gag order). The only thing left do would be to find excuses why no > warrant canary is being put up and trying to avoid public attention to > the topic. Which is exactly what's happening. You left out the part about the lizard people. > So please, Moxie, if this is *not* the case, state on this mailinglist, > publicly and in clear terms, that OWS or the server admins did not yet > receive a subpoena / warrant / gag order related to any OWS app or service. We have never received a subpoena, warrant, or gag order related to any OWS app or service. Now can we go back to writing software? - moxie -- http://www.thoughtcrime.org

4 4

Malaysian Minister of Information in 2007
by Ryan Carboni 19 Oct '14

19 Oct '14

https://www.youtube.com/watch?v=4nAWrQmTmI8 Reminds me of the current FBI director. Actually Baghdad Bob is the best government spokesperson in the history of fascism.

1 0

Re: Fwd: [whispersystems] Warrant Canary - Gag order in place
by Subrosa.io 18 Oct '14

18 Oct '14

Alternatively, it's also possible that Apple has received an order under Section 215 of the USA Patriot Act. >Date: Fri, 17 Oct 2014 10:26:25 +0100 >From: Alfie John <alfiej(a)fastmail.fm> >To: cypherpunks(a)cpunks.org >Subject: Re: Fwd: [whispersystems] Warrant Canary - Gag order in place > right now? >Message-ID: > <1413537985.1291115.180081117.257FD1CC(a)webmail.messagingengine.com> >Content-Type: text/plain > > Even Apple, which had the biggest market cap >in the world so could afford to take on this fight, bowed down and >removed their warrant canary recently. > >Sadly, until someone with a set of big brass ones goes all guns blazing >to specifically set precedent, everyone is going to sit on the sidelines >on this issue.

1 0

Legality of warrant canaries
by Griffin Boyce 18 Oct '14

18 Oct '14

Hey all, There's been a lot of discussion around warrant canaries lately, and I just want to pipe in with my experience. Back in 2012, I talked to my attorney about setting up a warrant canary or a dead man's switch -- which he pointed out would have the same legal repercussions as just releasing the gagged warrant/NSL. Why? Because they are frequently phrased in such a way that if you do or fail to do a thing to somehow make it known, then you've violated the order. You're in just as much trouble if you take out a billboard or tweet a scan of the order or use pantomime or comment out a warrant canary. The only difference is that there *might* be plausible deniability if you tell your partner "something happened at work today and I can't tell you what it is" [1], whereas you have *no* ability to deny anything if you remove a publicized warrant canary from a website. I'm not saying don't do it, but maybe talk to a lawyer first. ~Griffin [1] http://www.newyorker.com/tech/elements/what-its-like-to-get-a-national-secu… -- "I believe that usability is a security concern; systems that do not pay close attention to the human interaction factors involved risk failing to provide security by failing to attract users." ~Len Sassaman

7 6