- cypherpunks - lists.cpunks.org

Fwd: [tor-talk] Tor in the media - request for unsung positive narratives
by coderman 02 Oct '14

02 Oct '14

---------- Forwarded message ---------- From: Patrick <apexcp(a)gmail.com> Subject: [tor-talk] Tor in the media Hi everyone, Over the past few weeks, I've talked with a number of Tor people about how the project is portrayed in the media. As a reporter on this beat, the many legitimate criticisms the community have had strike pretty close to home for me. I don't think I need to tell this list why Tor's portrayal in the media is important, now more than ever. So, with the blessing and encouragement of a couple of official Tor people, I've got a question to ask of tor-talk (secure contact info follows at the bottom of the message): -- What untold but important stories about Tor are you willing to share? When writing about Tor, it's relatively easy to write about, for instance, popular hidden services (and I've admittedly done it plenty). The drug markets that advertise themselves and run a business are often more than willing to talk to reporters. They're even proactive about it. It's much tougher for a reporter to nail down important Tor stories about, as another example, domestic abuse victims using the software or political activists protecting their lives with it. That makes perfect sense, those people rely on anonymity in a much different way than enterprising drug dealers, but this reality makes it trickier for reporters to tell the full story when it comes to Tor. The trick, then, is to be proactive as well. I recently took a swing at writing precisely the kind of article I'm talking about--an untold but important story about how Tor is used in the wild--here: http://kernelmag.dailydot.com/issue-sections/features-issue-sections/10393/… ... I was inspired in large part by articles like this: http://betaboston.com/news/2014/05/07/as-domestic-abuse-goes-digital-shelte…. The BetaBoston article is very good, obviously, but it's a too-rare breed. I'd like to hear from anyone who might be willing to talk about (on the record or off) untold but important Tor stories that can shed light on the way the software serves its users. By design, I'll never get the full picture, but we can surely do more than surface scratching. If you have a story to tell, if you know someone who might, if you can think of others who I should be talking to, or if you have a good direction to point me in, I would love to hear from you. Or if you just want to talk more about Tor in the media, that's a topic I'm really interested in as well to be honest, so I'm happy to talk about that. If you're interested in talking (again, on the record or off, it's still valuable to hear stories I won't write about), you can find my contact info and PGP key at http://www.patrickhowelloneill.com/contact , you can email me here (my personal email), or at pat(a)dailydot.com. Obviously we can also work out other ways of communicating if need be. Thanks!

2 1

Fwd: [Cryptography] "Spy Agencies Urge Caution on Phone Deal"
by grarpamp 02 Oct '14

02 Oct '14

Number portability and more... trivially redirected to anywhere for MITM... courtesy Neustar. http://en.wikipedia.org/wiki/PSTN_network_topology http://en.wikipedia.org/wiki/Routing_in_the_PSTN http://en.wikipedia.org/wiki/Intelligent_Network http://en.wikipedia.org/wiki/Local_number_portability http://en.wikipedia.org/wiki/RespOrg http://en.wikipedia.org/wiki/Toll-free_number_portability http://en.wikipedia.org/wiki/North_American_Numbering_Plan http://en.wikipedia.org/wiki/Neustar http://www.npac.com/ http://leap.neustar.biz/ ---------- Forwarded message ---------- From: Jerry Leichter <leichter(a)lrw.com> Date: Mon, Sep 29, 2014 at 11:51 PM Subject: [Cryptography] "Spy Agencies Urge Caution on Phone Deal" To: Cryptography <cryptography(a)metzdowd.com> Not directly crypto-related, but an example of the tangle of relationships that drive surveillance: http://www.nytimes.com/2014/09/29/us/spy-agencies-urge-caution-on-phone-dea… reports on a backstage argument going on in Washington about a special network/database - oddly never named in the article - that "rout[es] millions of phone calls and text messages in the United States". Apparently this was a system created back in the late 1990's to implement number portability. It's not clear from the article whether it's a database of number-to-carrier mappings, or actually routes call based on such a database. A small Virginia company named Neustar created the system and has managed it ever since. Recently, the major carriers recommended to the FCC that Neustar be replaced by Telcordia, an American subsidiary of Ericsson, which allegedly can do the job more cheaply. The "intelligence community" has been pushed to leave the job in Neustar's hands, claiming that letting a European company run the system would leak important information about how US surveillance of the phone networks is implemented. Neustar, obviously no stranger to the Washington inside game, has hired good ol' Michael Chertoff to represent them. The bullshit and inside baseball and lobbying here runs so deep you can't see bottom. And underneath it all, another piece of the vast tapping network we've built in the US in the last 12 or so years is revealed, just a little bit. -- Jerry

1 1

BitNation
by Eugen Leitl 01 Oct '14

01 Oct '14

http://www.bitnation.co/ BITNATION IS A FULLY INCLUSIVE GOVERNANCE SYSTEM BITNATION offers a full range of services traditionally done by governments. We provide a cryptographically secure ID system, blockchain based dispute resolution, marriage and divorce, land registry, education, insurance, security, diplomacy, and more through a fully distributed platform.

3 3

Re: Email encryption for the wider public
by Henry Augustus Chamberlain 01 Oct '14

01 Oct '14

Hi all, Some very interesting points so far. To avoid making this email too long, I'm going to reply without quoting - I hope this doesn't inconvenience anyone. Regarding the memorability issue, all I can say is that end-to-end encryption really does require sharing 100+ bit keys - it's essential! You may be able to memorise your email address at the moment, but that's only half the story, since you can't memorise your public key! I can't solve every problem with PGP, but I still think this proposal solves a fair few of them. In some cases it improves on PGP, and in the other case it's at least no worse: you can still use online institutional directories etc if you want. Don't forget all the advantages this scheme could bring! Simplicity and transparency for the end user is really important! They're more likely to understand the significance of a public key if it forms part of the address (despite not understanding why it has to be this way). Perhaps it doesn't help Derek's mum - nor my mum, for that matter - but there are plenty of people for whom PGP is to complex whereas this scheme would be manageable. If you wish, you can send some emails encrypted and others unencrypted, just like you can with PGP - in this case, you'd just need two addresses (which is surely no worse than PGP, where you have an address and a key). Regarding telephone conversations: if it's with a mobile phone, perhaps a text message would work; if it's a landline, you probably have internet access, so an initial unencrypted email would work if you're not worried about man-in-the-middle attacks. (If you are worried about such attacks, then a bit of effort might be required, beyond just rattling off a short email address over the phone.) By the way, I'm suggesting printable characters to encode the key, not arbitrary bytes. An alphanumeric character stores nearly 6 bits (or 5 if it isn't case-sensitive), so 256-bit keys would require around 50 characters. Email standards allow 64 characters for the local part of the address, so there's room for error-correction too. Regarding the point about forged email addresses: for cryptography to work, you need to identify people using their keys, not their addresses. With PGP, you could send an email to my mum, using my email address but the wrong signature; if my mum is just relying on the email address, then that defeats the purpose of PGP. Of course, most PGP systems compare the key with that stored in the address book; a similar system can be used for my proposal, but with the advantage that forged emails don't give rise to the situation where the address is known but the key is unknown, which might lead a naive user to assume something's broken with the crypto software. Regarding webmail... I still haven't solved that one. Maybe there's an inherent contradiction in trying to include webmail in an end-to-end encryption system. I like the idea of using the "address+key(a)gmail.com" technique, although it does contradict the idea of "identify people using the key, not the address". Also, in my original proposal, I suggested using the private key (instead of a password) to login to the email server. I reckon Gmail is unlikely to allow that in the near future :) Best wishes, Henry

3 2

How worse is the shellshock bash bug than Heartbleed?
by Georgi Guninski 01 Oct '14

01 Oct '14

Recently a bash(1) bug called shellsock died. It affected Apache, DHCP, SSH,qmail,Pure-FTPd and other stuff. Summary of affected: https://github.com/mubix/shellshocker-pocs/blob/master/README.md I find this _much_ worse than the passive Heartbleed. How worse is the shellshock bash bug than Heartbleed?

6 10

Offering free firmware rootkits perhaps even badBIOS
by bluelotus＠openmailbox.org 01 Oct '14

01 Oct '14

Want firmware rootkits, probably more sophisticated than FinFisher's, probably BadBiOS, emailed to you? Hidden .mp3 and ID3 tag embedded in .exif in photos I took. Clicking on the photos does not produce audible sound. Is audio ultrasound? http://www.reddit.com/r/badBIOS/comments/2hd3ia/is_hidden_mp3_in_hidden_exi… JavaScript block, multiple objects, multiple stream objects, OpenAction and JFIF in documents that I scanned into PDF. http://www.reddit.com/r/badBIOS/comments/2gzbt6/infected_music_other_object… Malware hiding in revisions, OLE2 streams and null characters after the end of file of doc files I had created. Null characters after the end of file of tiff files. http://www.reddit.com/r/badBIOS/comments/2h91bb/ole2_streams_in_doc_files_a… I removed ID3 tags from music. Hackers concealed reinserting ID3 tags. http://www.reddit.com/r/badBIOS/comments/2h6nuk/hidden_infected_id3_tags_in…

3 2

Firechat, this «freedom of speech-app» is bogus
by Xavier 30 Sep '14

30 Sep '14

Hello there, Mostly I'm just a lurker here but for once I will ask some questions/make remarks about Firechat. As you may know, this app just got extensive media coverage due to their widespread use in Hong Kong «Occupy-central». Check on the Guardian for example: www.theguardian.com/world/2014/sep/29/firechat-messaging-app-powering-hong-… So, out of curiosity, I just downloaded the app. Below are my remarks on the process: - You can't directly download the apk from the website. For android, the only link available is from the Google store. As if, if you really need privacy and freedom of speech, the first thing that you do is have a google account linked to your android device. I downloaded the app from Aptoide, but well… - Once you download the app, required permissions include: - Localization - Read contacts - Search accounts on the device How are those permissions necessary ? I just want to connect to nearby people. I don't need firechat servers to point me to those people nor to know where I am or with whom I chat. - Once you launch the app, there comes the cherry on the cake, you need to have properly activated and updated Google Play background services in order to run the app. I suppose that it implies that you must have a Google account linked to your device and that, thanks to the «Search account» permission, Firechat just like Google are perfectly aware of who you exactly are ?? If my goal was just to chat with my neighbors without paying during the Worldcup, that would be fine, but the problem here is that this app is now also marketed in newspapers as a privacy app, thanks to Hong Kong protests. When the product was released a few month ago, I already tried it but abandoned immediately due to those privacy problems. What I want first of all is privacy, not to avoid paying my provider. Now I understand that for Hong Kong people this is a lesser evil solution because they fear an Internet shutdown, but well, I am disappointed to remark that «freedom-of-speech» and «privacy-aware» are so strongly disconnected even in a promising app like this one. Xavier

5 4

Bitcoin mining ASIC decapped
by Peter Gutmann 30 Sep '14

30 Sep '14

In case anyone's interested, this site: http://zeptobars.ru/en/read/bitfury-bitcoin-mining-chip has some photos of what looks like a decapped Bitfury ASIC. It's a pretty unique structure... Peter.

3 2

Julian Assange Speaks with teleSUR English
by Damian Fossi 30 Sep '14

30 Sep '14

http://www.youtube.com/watch?v=POzBnAT7ZoQ In an exclusive interview with teleSUR English, WikiLeaks founder Julian Assange has warned Google has “lulled” the world into a false sense of security. WikiLeaks founder Julian Assange has warned Google and the U.S. government are collaborating to create the most advanced surveillance state the world has ever seen. In a secret meeting in 2011, Assange says he caught a glimpse into the inner workings of the Google “empire,” and its intimate relationship with the U.S. government. “Google is literally in bed with the State Department,” he told teleSUR English in an exclusive interview. -- Damián D. Fossi Salas > ¡Software Libre hasta el 2 mil siempre! http://damian.fossi.me Uso: Debian GNU/Linux con Kernel 3.12.6-libre Linux User: 188464 Jabber ID: dam1an en chat.cpunks.us Twitter.com > http://twitter.com/dam1an

1 0

Manufacturing open hardware
by bluelotus＠openmailbox.org 29 Sep '14

29 Sep '14

http://www.datamation.com/open-source/what-linux-users-should-know-about-op…

1 0