- cypherpunks - lists.cpunks.org

Novena update
by Eugen Leitl 17 Oct '14

17 Oct '14

Bunnie seems on track. Wonder what the price tag for rubes will be. http://www.bunniestudios.com/blog/?p=4146

2 1

Re: Corporate undercover nation-state agents
by Snehan Kekre 16 Oct '14

16 Oct '14

1 0

Corporate undercover nation-state agents
by bluelotus＠openmailbox.org 16 Oct '14

16 Oct '14

https://firstlook.org/theintercept/2014/10/10/core-secrets/ "But the briefing document suggests another category of employees—ones who are secretly working for the NSA without anyone else being aware. This kind of double game, in which the NSA works with and against its corporate partners, already characterizes some of the agency’s work, in which information or concessions that it desires are surreptitiously acquired if corporations will not voluntarily comply. The reference to “under cover” agents jumped out at two security experts who reviewed the NSA documents for The Intercept. “That one bullet point, it’s really strange,” said Matthew Green, a cryptographer at Johns Hopkins University. “I don’t know how to interpret it.” He added that the cryptography community in America would be surprised and upset if it were the case that “people are inside [an American] company covertly communicating with NSA and they are not known to the company or to their fellow employees.” The ACLU’s Soghoian said technology executives are already deeply concerned about the prospect of clandestine agents on the payroll to gain access to highly sensitive data, including encryption keys, that could make the NSA’s work “a lot easier.” “As more and more communications become encrypted, the attraction for intelligence agencies of stealing an encryption key becomes irresistible,” he said. “It’s such a juicy target.”

4 5

Crypto mechanics in ios8 and android L
by grarpamp 16 Oct '14

16 Oct '14

http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your… http://nelenkov.blogspot.com/2014/10/revisiting-android-disk-encryption.html That's the frontdoor. Baseband's still present and wide open. Thus consider a non-cell device (a pad/laptop) tethered to cell hotspot or another phone to provide mobile wifi voice/data (IP) to the device. Is connecting to a cell hotspot or another phone to use the native cell voice/data (cell) of the cell network even possible? ie: You can drive a phone's sms over it's usb port. But that's just sms, not cell voice or cell IP.

6 6

Re: [Cryptography] Cryptography, backdoors and the Second Amendment
by Lodewijk andré de la porte 16 Oct '14

16 Oct '14

This e-mail turned out huge enough that I think I'll not have to speak about the subject again any time soon. I'd still like to listen :) 2014-10-13 5:42 GMT+02:00 Jerry Leichter <leichter(a)lrw.com>: > On Oct 12, 2014, at 12:31 PM, Lodewijk andré de la porte <l(a)odewijk.nl> > wrote: > > Ah, but that wasn't the question. A judge must always give precedence to > constitutional laws. How could a judge explain the second amendment such > that machine guns could be illegal? > > I suspect that ruling should be exceedingly controversial and dangerous. > > This is absurdly far from cryptography, but ... the following is a summary > of the article on the subject in Wikipedia - > http://en.wikipedia.org/wiki/United_States_v._Miller. > But surprisingly relevant. Law is supposedly coherent and, nowadays, all encompassing. An argument valid in the US will hold in all the Western countries, and probably those are or pretend to be developed nations as well. I've thought and read about the subject some more. It's relevant, bizarre, historic and, like many judgements are, of incredible importance. > Private ownership of machine guns has been regulated in the US since 1934, > when the National Firearms Act was passed in response to the Valentine's > Day Massacre, an infamous gang killing. The NFA required registration of > fully automatic weapons and some others, like short-barrelled rifles. > Registration, and every subsequent transfer, required payment of a $200 fee > - a very large sum in those days. > > The controlling decision is US v. Miller, decided by the Supreme Court in > 1939. It's a bizarre case. Miller was a bank robber arrested while > transporting a short-barrelled shotgun across state lines. Miller > testified against his partners, and later disappeared, presenting no > defense to an appeal to the Supreme Court. (In fact, Miller was found > murdered before the decision was rendered.) The US government appeal was > based, among other things, on the interpretation of the reference to "a > well-ordered militia" to say that the protected rights are to arms actually > used by militias. Miller was transporting a short-barrelled shotgun - a > weapon the government claimed was never used by any known militia. (This > claim was actually false, but because no one appeared for the defense, no > one disputed it.) > So, there's no proper judgement on it as of yet. Shocking, given how core weaponry is to much of the US' image. My personal opinion is that the 200usd claim cannot constitutionally be charged, as it could, for some, infringe the ability to bear arms, thus preventing them from obtaining/executing their right. I do think they could charge it provided they do not charge it to someone that can trivially afford it, although avoiding the difficulty in finding that price point has strong preference. I say this mostly because of a European Court judgement against The Netherlands regarding a visa for family members costing a prohibitive per family member, afterwards a maximum price was determined with no regard to applicants' ability to apply for it. A still unsatisfactory situation, but it wouldn't be practical otherwise. The Supreme Court, however, found other reasons to find that the NFA was > likely constitutional, and remanded the case to the district court for > further proceedings. But with Miller dead, those further proceedings never > occurred. The Supreme Court never actually considered the whole issue of > whether a short-barrelled shotgun was, in fact, ever used by a militia; nor > whether that matter anyway; never came up. > It shouldn't be a big difference. The only thing to do is become part of a militia, which is a really good idea anyway ("nesssary to the security of a free State"). The question of which weapons could be of use is easy, ALL OF THEM! Textwise the second amendment is not explitic about which arms must be allowed to be carried, so there's a bit of a hole there. It wouldn't be a meaningfull text if it didn't refer to all arms equally. > The case, which forms the basis for limiting access to some kinds of > weapons, has barely been cited since. In effect, even though there never > really was such a decision, the Court has seen Miller as standing for the > rule that weapons not used by militias may be regulated or banned. In a > 1997 case, Justice Thomas - that far-left liberal - wrote in a concurring > opinion to Printz v. US that "In Miller, we determined that the Second > Amendment did not guarantee a citizen's right to possess a sawed off > shotgun because that weapon had not been shown to be "ordinary military > equipment" that could "contribute to the common defense." In 2008, in a the > very important decision invalidating most of the District of Columbia's gun > control regulations (District of Columbia v Heller), the opinion included > the statement that "Miller stands only for the proposition that the Second > Amendment right, whatever its nature, extends only to certain types of > weapons. It is particularly wrongheaded to read Miller for more than what > it said, because the case did not even purport to be a thorough examination > of the Second Amendment." > I would say there's some syntax/semantics going wrong there. If an entity (item/service/organization/idea/etc) does not contribute to "the common defense" or such a thing if controlled/used by a disciplined/trained organization of people, how could it be a weapon? If it is not "arms", then it could not be protected by the second amendment. That's a signficantly wider category than arms is typically considered to be. But making it smaller is difficult against the thorn of time. So for better or worse, the Supreme Court standard now is that the > protected arms are those that are useful to, and used by, militias - > whatever we take that word to mean; it had a specific meaning in the 18th > century that's no longer of any relevance. Whatever the *actual* facts, > sawed-off shotguns - and apparently fully-automatic weapons - are among the > things that can be banned as "not the right sort of weapons". > That's such a non-sequitor that I feel like I just don't understand, but it's probably just how it is. If the People let their rights be taken from them, by those elected by them, then there is no helping it anyway. > The law is not a simple or pretty thing. It evolves in sometimes > arbitrary ways - note the angst over rulings that treat corporations as > people, which all trace back to a side comment in a footnote in a decision > in a case about something else, which somehow has frozen into a major > principle. (Well, the "somehow" is quite clear: The courts are big on an > idea call stare decisis, which basically means "let sleeping dogs lie": > Unless there is a really, really good reason, the strong bias is to leave > decisions and interpretations that people have come to rely on alone, > avoiding major disruption, whatever their basis.) > It is in many ways their job to interpret the law the way it is commonly accepted to be. Treating legal persons, corporate or corporal, similarly is pretty reasonable. It's just when it disempowers people where it should do the opposite that angst really starts seeping in. There should be recognition of capabilities, an individual or small company cannot (may not?) be expected to be able to perform like a larger company can. Different people can neither be expected to perform to the same standards, for example in case of mental illness. > The Second Amendment's bizarre language has been a problem pretty much > since it was written, and while there have been changes in interpretation > over the years - and there has definitely been a strong trend in recent > years for scholars and judges of all political persuasions to see it as a > stronger protector of an individualized right than was the case in the past > - things like Miller have grown up around it and have also, for now, become > settled law. > Thank you for the dissertation. It was well received :) I think no judge can sanely claim gun regulations that restrict the right to bear arms to be constitutional. Specifically of paramount and contemporary importance is the protection against a tyranical government, and foreign attacks from geopolitical powers like China and Russia and, most Catch-22ish terrorists and murderers, in mass shootings or otherwise. I would very much appreciate people being encouraged to take arms in the context of militia's. A single armed man is not reliable enough, nor capable enough, to contribute meaningfully to the common defense or any such thing. I also would bid the United States' federal government to provide an interpretation of the second amendment that allows the states to prevent purchase or transfer of certain devices when not in conjunction with a militia. That militia's may be registered at the state or federal government, at no charge to them, limited only in that it requires several natural persons to create it and that these natural persons may only participate in three militia's. That militia's must in some shape or form encourage the discipline to comply with laws as they apply in their area of operation, lest they are an encouragement of criminal behavior and are indeed not militia's at all. And more such rules as provide a regulated environment in which one may justly execute his or her right to keep and bear arms After all, a device handled by one not trained to use it can never be arms at all. ------------ To apply this directly to cryptography: export and import could still very well be made illegal. The truth is that information should be free, because without free information reality becomes distorted in ways that can cause harm beyond belief.** I seem to have ran offtopic there. It was meant to prove that information is going to have a lot of changes to it, and knowledge about crypto is fundamentally information. Important and export restrictions are silly. ** ramblings with value perchance moved here because I actually do care about not wasting your time (it's just hard to avoid, sorry about that): The world is not ready for it, but through technological means we are become increasingly capable of making all information stored in computers easily accessed. There is fighting against it but it will not succeed and every person harmed in it is a person too many. We much guide it, lest much else will be lost, copyright and trade secrets have their place for now. However, not just our ability to store and examine information is becoming more and more unlocked. The ability to create and collect information has been growing at least as explosively. The cost of a networked video camera's and microphones is dropping and will continue doing so until every place humans live will be recorded, for ever increasing durations, as any crime's cost to humanity will exceed the cost of placing the recording device. You might think privacy, shame and just the fabric of society will not accept it. And it's true. The whole fabric will tear and tear until privacy becomes ridiculous. Not because privacy isn't a great thing now, it is!, but because as we will come to understand and tolerate each other it will become irrelevant. That's a dreamy outlook on it. Another is a police superstate wherin humans have no real place except as biological machinery.

2 1

State Hash
by John Young 15 Oct '14

15 Oct '14

http://sphincs.cr.yp.to/ Special note to law-enforcement agents: The word "state" is a technical term in cryptography. Typical hash-based signature schemes need to record information, called "state", after every signature. Google's Adam Langley refers to this as a "huge foot-cannon" from a security perspective. By saying "eliminate the state" we are advocating a security improvement, namely adopting signature schemes that do not need to record information after every signature. We are not talking about eliminating other types of states. We love most states, especially yours! Also, "hash" is another technical term and has nothing to do with cannabis.

4 6

IANA Stewardship Transition - WAS: Radical-safest TLDs in 2014
by Travis Biehn 14 Oct '14

14 Oct '14

Survey and ML [soliciting feedback from the general public] for stewardship transition: https://www.surveymonkey.com/s/IANA_stewardship http://lists.arin.net/mailman/listinfo/iana-transition -Travis On Tue, Oct 7, 2014 at 5:08 AM, Cathal Garvey <cathalgarvey(a)cathalgarvey.me> wrote: > > Can we further reduce ambiguity by reducing the set to those TLDs > > recognized by ICANN? > > Isn't it more useful to reduce the set to TLDs that the "average user" > can connect to? That's why I shared the rumours about .onion in Firefox: > who cares what ICANN thinks, if a large enough userbase can access it > OOTB without configuration? > > By contrast, .onion *today*, along with .i2p and .bit, are all > configuration-heavy, meaning virtually nobody will actually access or > use them unless they're already completely dedicated customers. The Silk > Road managed to pull people in because it was essentially the only place > to buy drugs "safely" online (along with plenty of other reprehensible > things), but that's a completely exceptional case. > > I'm thinking of benign web services that enrich the world in some way, > but suffer censorship or legal assault because they disturb the > status-quo. The next start-up that MPAA want to crush, or the next > whistleblowing site, or the next transborder social network. Those > people will need TLDs they can rely on. If .onion goes surprisingly > mainstream in the near future, that'd be very powerful. > > Of course, .onion will remain slow as sin, but for those websites they > can use .onion with 304 redirects to non-onion TLDs for each visitor; as > their clearnet TLDs get shut down they can just register new ones and > 304 redirect to them on the fly for each new visitor; whack-a-mole on a > grand scale, a total losing battle for the censors. The critical bit is > that there's one canonical URL for new visitors that will always lead to > service. > > On 06/10/14 21:00, Travis Biehn wrote: > > Rysiek, > > Can we further reduce ambiguity by reducing the set to those TLDs > > recognized by ICANN? > > > > I don't think you can 'rely' on any of them, to coderman's point. > > > > Your best bet is to enumerate the list of TLD delegated authoritative > > servers, then recursively send legal threats to each. > > > > The one who demonstrates the most impressive apathy may be your winner :) > > > > Of course, you may want to follow the concept of pitting two > noncooperative > > countries against each other. > > If the threat to your name isnt specifically tied to a subset of all > > jurisdictions.. You might have a problem. > > > > You might, then, establish a protocol. The hash of the website CNN.com's > > contents, for instance, may serve as a backup domain. > > > > Realistically its really down to finding a cool registrar & TLD pair. TBP > > may be your best example here. > > > > As a final note: if you're worried about these kinds of problems you > > probably shouldn't be using clearnet. > > > > Travis > > On Oct 5, 2014 6:50 PM, "coderman" <coderman(a)gmail.com> wrote: > > > >> On 10/5/14, rysiek <rysiek(a)hackerspace.pl> wrote: > >>> ... which TLD should I choose for a "clearternet" > >>> version of the website? > >> > >> > >> for present day, "clearnet" version, > >> winner is .bit / namecoin. > >> > > > > -- > Twitter: @onetruecathal, @formabiolabs > Phone: +353876363185 > Blog: http://indiebiotech.com > miniLock.io: JjmYYngs7akLZUjkvFkuYdsZ3PyPHSZRBKNm6qTYKZfAM > -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

1 0

Ubuntu's QA and skills at patching
by Georgi Guninski 14 Oct '14

14 Oct '14

lol :) https://lists.ubuntu.com/archives/ubuntu-security-announce/2014-September/0… USN-2363-1 fixed a vulnerability in Bash. Due to a build issue, the patch for CVE-2014-7169 didn't get properly applied in the Ubuntu 14.04 LTS package. This update fixes the problem. We apologize for the inconvenience.

3 4

Re: [liberationtech] With This Tiny Box, You Can Anonymize Everything You Do Online | WIRED
by Travis Biehn 13 Oct '14

13 Oct '14

+cpunks Interested in update mechanisms, interdiction resilience, trusted boot, web / other interfaces. These devices just change and expand your threat surface. Travis On Oct 13, 2014 12:21 PM, "Yosem Companys" <companys(a)stanford.edu> wrote: > Today a group of privacy-focused developers plans to launch a Kickstarter > campaign for Anonabox. The $45 open-source router automatically directs all > data that connects to it by ethernet or Wifi through the Tor network, > hiding the user’s IP address and skirting censorship. It’s also small > enough to hide two in a pack of cigarettes. Anonabox’s tiny size means > users can carry the device with them anywhere, plugging it into an office > ethernet cable to do sensitive work or in a cybercafe in China to evade the > Great Firewall. The result, if Anonabox fulfills its security promises, is > that it could become significantly easier to anonymize all your traffic > with Tor—not just Web browsing, but email, instant messaging, filesharing > and all the other miscellaneous digital exhaust that your computer leaves > behind online. > > “Now all your programs, no matter what you do on your computer, are routed > over the Tor network,” says August Germar, one of the independent IT > consultants who spent the last four years developing the Anonabox. He says > it was built with the intention of making Tor easier to use not just for > the software’s Western fans, but for those who really need it more > Internet-repressive regimes. “It was important to us that it be portable > and small—something you can easily conceal or even throw away if you have > to get rid of it.” > > http://www.wired.com/2014/10/tiny-box-can-anonymize-everything-online/ > h/t @anahi_ayala > > -- > Liberationtech is public & archives are searchable on Google. Violations > of list guidelines will get you moderated: > https://mailman.stanford.edu/mailman/listinfo/liberationtech. > Unsubscribe, change to digest, or change password by emailing moderator at > companys(a)stanford.edu. >

3 3

RC4 Forevar! [was: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4]
by coderman 13 Oct '14

13 Oct '14

On 9/22/14, coderman <coderman(a)gmail.com> wrote: > ... >> Please elaborate. TKIP has not been identified as a ‘active attack’ >> vector. hi nymble, it appears no one cares about downgrade attacks, like no one cares about MitM (see mobile apps and software update mechanisms). [0] > to be specific about the problems, in case not concise enough above: > 0. lack of a way to enforce TKIP disable. > 1. lack of visual signal of TKIP downgraded security in WPA2 to users. > 2. insult to injury with "unspecified" bozofail TKIP transition to ON > flaws in some hw. i would like to clarify that #0 is a driver domain behavior, your "suggestions" from userspace via wpa-supplicant are meaningless against the motivated. also, the definitive paper at http://www.isg.rhul.ac.uk/tls/ still insists, "For WPA/TKIP, the only reasonable countermeasure is to upgrade to WPA2." which is either incompetently incorrect, or intentional indirection. best regards, 0. "no one cares" - this is not strictly true; people care a bit more if you have done significant and detailed analysis of the sort that eats lives by the quarter-year. i have long since quit giving freebies freely, and instead pick my disclosures carefully with significant limitations. perhaps i should re-state: "no one working in the public interest cares". there is a roaring business for silence and proprietary development, and these people care quite a bit.

1 1