- cypherpunks - lists.cpunks.org

Re: [Cryptography] cryptography Digest, Vol 16, Issue 26
by grarpamp 01 Sep '14

01 Sep '14

On Wed, Aug 27, 2014 at 3:21 PM, Peter Trei <petertrei(a)gmail.com> wrote: > On 26 Aug 2014 21:28:49 -0000 "John Levine" <johnl(a)iecc.com> wrote: > > Subject: Re: [Cryptography] toll bills, was Encryption opinion > >>> I've not been on any of those > ?>roads, but I've gotten three e-mailed bills in the last two weeks >>>that to the unskeptical eye look fully legitimate, which also >>>indicates that the phishers know that my geolocation makes driving >>>such roads plausible. > >> It's not geolocation, everyone is getting E-ZPass spam this month. I >> have an E-ZPass account, and can report that it looks nothing like the >> real mail they send, which just tells you to look at their web site >> for a statement or other message. This is aimed at the same kinds of >> suckers who fall for 419. > >> I also got an actual e-mail this month from an actual toll road >> telling me about an actual charge due to actually driving on it. It >> was the 407 in Toronto, not E-ZPass, and I knew they'd be billing me >> so I set up an account so they'd e-mail me instead of the default >> paper bill, but still ... > >> John > >> PS: So is there any crypto on toll transponders, or could I >> skim them from the side of the road and make clones? > > Apparently some do, most don't. EZ Passes are made by > Kapsch (Kapsch.net) which has data sheets available, and has > made their protocols open source. > > You can easily modify one to inform you of when its queried: > http://www.popsci.com/article/diy/ezpass-hack-covert-scanning " Bear <bear(a)sonic.net> Aug 28 (4 days ago) I've got one. It's an envelope lined with copper foil. I get the pass out when approaching a toll booth, and put it back (and put the 'chip clip' back on the envelope to ensure that the foil makes good electrical contact) as I pull away from the toll booth. A toggle switch would be nice, but we can be fairly confident that a Faraday cage is working as designed. Bear. " > ...and it turns out they're queried all over the place, not just at > tolls. There have been proposals for a 'kill switch' which would > allow you to disable it except when approaching a toll, but I > haven't seen that. > > But its moot, anyway. Transponders are being replaced by > license plate scanning. This is yet another case where we > accepted something (permanently visible LPs) on the basis > that no one could track every plate, everywhere, all the time. > Technology moved on, and invalidated that promise of > privacy-unless-they-really-really-need-to-violate-it. So you need active defense of plate masks/obfuscation mechanichs... flip down blanking devices, character cards, mask films on a loop roll motor, OLED plates. DIY 007. Drive masked, reveal as needed. Worst case, you don't notice the cop car near you and get a paper ticket for no plate or a hacked random nonspec plate. $100+... better than daily loss of privacy to intersection/roadside cams, google robot cars, etc. Next battle... killing all the manufacturer supplied transponders in your car... Then your cell phone.

1 0

[tt] NYT: Hal Finney, Cryptographer and Bitcoin Pioneer, Dies at 58
by Eugen Leitl 01 Sep '14

01 Sep '14

----- Forwarded message from Frank Forman <checker(a)panix.com> ----- Date: Mon, 1 Sep 2014 00:35:43 +0000 (GMT) From: Frank Forman <checker(a)panix.com> To: Transhuman Tech <tt(a)postbiota.org> Subject: [tt] NYT: Hal Finney, Cryptographer and Bitcoin Pioneer, Dies at 58 Message-ID: <Pine.NEB.4.64.1409010035310.8967(a)panix2.panix.com> Hal Finney, Cryptographer and Bitcoin Pioneer, Dies at 58 http://www.nytimes.com/2014/08/31/business/hal-finney-cryptographer-and-bit… By NATHANIEL POPPER Hal Finney, a cryptographer and one of the earliest users and developers of the virtual currency Bitcoin, died on Thursday in Phoenix. He was 58. Mr. Finney had been paralyzed by amyotrophic lateral sclerosis, or A.L.S., and was taken off life support at Paradise Valley Hospital, his wife, Fran Finney, said. She said his body was immediately prepared for cryonic preservation by the Alcor Life Extension Foundation in Scottsdale, Ariz., according to his wishes. A graduate of the California Institute of Technology, Mr. Finney was a longtime futurist who put his programming skills to work in the service of his ideals, particularly his desire to see the privacy of individuals protected. In 1991, he began doing volunteer work for a new software project known as Pretty Good Privacy, or P.G.P., and immediately became one of the central players in developing the program. P.G.P. aimed to make it possible for people everywhere to encrypt electronic communication in a way that could not be read by anyone other than the intended recipient. The program used relatively new innovations in encryption that are still thought to be invulnerable to code breakers. Mr. Finney wrote in 1992 that cryptographic technology appealed to him because he worried about the ability of corporations and governments to snoop on citizens. "The work we are doing here, broadly speaking, is dedicated to this goal of making Big Brother obsolete," he wrote to an online group of fellow privacy activists. The original author of P.G.P., Philip R. Zimmermann, quickly became the target of federal prosecutors, who believed that the software broke United States laws against exporting military-grade encryption software. While the investigation went on and became a major cause for civil libertarians, Mr. Finney played a more quiet role in P.G.P. to avoid becoming a target himself. Mr. Zimmermann said in an interview that this decision meant Mr. Finney did not get proper credit for some of the important innovations he had made in the development of P.G.P. When the investigation concluded in 1996 without any charges being filed, P.G.P. became a company, and Mr. Zimmermann set out to hire Mr. Finney as his first employee. Mr. Zimmermann, in an interview before Mr. Finney died, said Mr. Finney was unusual in the field because he had none of the asocial tendencies and physical awkwardness that are commonly associated with people in the programming world. Rather, he said, Mr. Finney was a gregarious man who loved skiing and long-distance running. "Sometimes people pay some price for being extremely smart--they are deficient in some emotional quality," Mr. Zimmermann said. "Hal was not like that." While working on P.G.P., Mr. Finney was a regular participant in a number of futurist mailing lists, the most famous of which gave birth to the Cypherpunk movement, dedicated to privacy-enhancing cryptography. Following these lists, Mr. Finney became fascinated by the concept of digital currencies that could not be tracked by governments and banks. He was involved in many experiments aimed at creating an anonymous form of digital money, including his own invention, in 2004, of reusable proofs of work. Though that system never took off, he quickly saw the promise of the Bitcoin project when it was announced on an obscure email list in 2008 by a creator with the pseudonym Satoshi Nakamoto. Bitcoin used some of the same cryptographic tools harnessed by P.G.P. and held out the promise that participants could choose to be anonymous when spending money online. When the project drew criticism from other cryptographers, Mr. Finney was among the first people to defend it. He downloaded the Bitcoin software the day it was released. The day after that, he took part in the first transaction on the network when Satoshi Nakamoto sent him 10 Bitcoins. His early work on Bitcoin and his programming background led to frequent speculation in the Bitcoin community that Mr. Finney was Satoshi Nakamoto, a claim he always denied. Soon after getting started with Bitcoin, Mr. Finney learned in 2009 that he had A.L.S., and he withdrew, for a time, from active participation in the project. Harold Thomas Finney II was born on May 4, 1956, in Coalinga, Calif., to Virginia and Harold Thomas Finney. His father was a petroleum engineer. After graduating from Caltech in 1979 with a degree in engineering, he worked for a company that developed video games like Astroblast and Space Attack. As a young man, Mr. Finney developed an interest in preserving life through cryonic freezing until better, life-enhancing technologies were invented, said a college roommate, Yin Shih. In 1992, Mr. Finney visited the Alcor facility with his wife to determine whether he wanted to sign up his family to be preserved in Alcor's "containment vessels." "In my personal opinion, anyone born today has a better than 50-50 chance of living effectively forever," he wrote at the time. Mr. Finney remained an employee of the P.G.P. Corporation until his retirement in 2011, working from his home in Santa Barbara, Calif. In the last few years, Mr. Finney was able to move only his facial muscles, but he communicated and wrote Bitcoin-related software using a computer that tracked his eye movement. "I'm pretty lucky overall," Mr. Finney wrote on a Bitcoin website in 2013. "Even with the A.L.S., my life is very satisfying." As the price of Bitcoins rose, his family, to pay for his medical care, was able to sell some of the coins he secured in the early days. Besides his son, Jason, and his wife, he is survived by a daughter, Erin Finney; two sisters, Kathleen Finney and Patricia Wolf; and a brother, Michael. His wife, a physical therapist whom he met at Caltech, spent most of her days caring for him in his final years. After Mr. Finney's death, the freezing of his remains was announced by another futurist, Max More. "Hal," he wrote in a statement online. "I know I speak for many when I say that I look forward to speaking to you again sometime in the future and to throwing a party in honor of your revival." _______________________________________________ tt mailing list tt(a)postbiota.org http://postbiota.org/mailman/listinfo/tt ----- End forwarded message -----

2 1

[Bitcoin-development] Testing and reviewing requested for work on Bitcoin Core wallet
by Eugen Leitl 01 Sep '14

01 Sep '14

----- Forwarded message from Wladimir <laanwj(a)gmail.com> ----- Date: Mon, 1 Sep 2014 10:25:23 +0200 From: Wladimir <laanwj(a)gmail.com> To: Bitcoin Dev <bitcoin-development(a)lists.sourceforge.net> Subject: [Bitcoin-development] Testing and reviewing requested for work on Bitcoin Core wallet Message-ID: <CA+s+GJD_sKjJ52dA6W0aj1tPNV8bTCqX9H0iuQ56bpi6w3s7wg(a)mail.gmail.com> Hello, Cozz Lovan has been doing great work on Bitcoin Core's wallet code lately. If anyone cares about Bitcoin Core's wallet, for example its performance, do help testing and reviewing these improvements so that they can make it into 0.10: Subtract fee from amount https://github.com/bitcoin/bitcoin/pull/4331 [Wallet] Improve ReorderTransactions(..) https://github.com/bitcoin/bitcoin/pull/4697 [Wallet] Replace OrderedTxItems(..) with in-memory map https://github.com/bitcoin/bitcoin/pull/4702 [Qt] Call checkBalanceChanged() periodically instead for every updated tx https://github.com/bitcoin/bitcoin/pull/4712 Move g_signals.SetBestChain(..) below SyncWithWallets https://github.com/bitcoin/bitcoin/pull/4798 [Wallet] Call SetBestChain before and after rescan https://github.com/bitcoin/bitcoin/pull/4800 [Wallet] Do not flush the wallet in AddToWalletIfInvolvingMe(..) https://github.com/bitcoin/bitcoin/pull/4805 Wladimir ------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/ _______________________________________________ Bitcoin-development mailing list Bitcoin-development(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development ----- End forwarded message -----

1 0

Update on interdiction, secret GSM
by bluelotus＠openmailbox.org 29 Aug '14

29 Aug '14

I purchased the latest smartphone with a slider qwerty keyboard. A Motorola Droid 4 with CM11 and a T5 torx screwdriver from Ebay. The two T5 screws to the battery ribbon cable had been glued. I discarded the smartphone. http://www.reddit.com/r/privacy/comments/2e7lwl/of_mylar_bags_to_block_phon… Nook Tablet with CM 10 arrived DOA. I could not go past the CM welcome screen. Tablet wouldn't shut down or reboot. I returned it to the seller. MIPS tablet #1 didn't charge via USB port, was missing file manager, Adobe Reader, Skype and app installer, would not mount my SD card and bricked my 16 GB SD card. I tried to use tablet #1's micro USB port to copy my personal files but tablet's USB port would not function. http://www.reddit.com/r/badBIOS/comments/2ejydo/mips_processors_are_rare_mo… MIPS tablet #2 did charge via USB port, was missing app installer but had file manager, Adobe Reader, Skype and two games whereas tablet #1 did not have any games, mounted my SD card but bricked my 8 GB SD card. I was able to copy my personal files using the tablet's micro USB port. http://www.reddit.com/r/badBIOS/comments/2el93r/cannot_air_gap_mips_tablet/ aLogcat logs disclose secret GSM in MIPS tablet #2: http://www.reddit.com/r/badBIOS/comments/2eub37/secret_gsm_in_mips_tablet_i… Hours after posting the above thread yesterday, my MIPS tablet #2 was stolen from my room. Were my laptops implanted with GSM and infected with firmware rootkits when they were interdicted? I had assumed FM radio transceiver/beacon implants or badBIOS. Many of the linux /var/logs I was denied permission to read even though I had logged into the graphical desktop on my laptops. A few of the /var/logs were of unknown file type. The type was unknown to the file manager. Had the firmware rootkits not tampered with the /var/logs, GSM may have been reported in the logs. Military contractors getting special access to surveillance programs. https://www.youtube.com/watch?v=JyT7yzap1Wc Greenpeace loses lawsuit over being hacked by former NSA hackers hired by private investigators hired by corporation http://readersupportednews.org/opinion2/277-75/25479-focus-corporations-spy… "Last year, California’s Pacific Gas and Electric Company (PG&E) was required after an investigation to pay $390,000 to the state’s General Fund after it was discovered that they were spying on anti-smart meter activist groups." http://www.foxnews.com/us/2014/04/17/is-your-home-energy-meter-spying-on/

1 0

[tor-talk] New Announcement: Qubes + Whonix is now available!
by Eugen Leitl 29 Aug '14

29 Aug '14

----- Forwarded message from whonixqubes(a)mail2tor.com ----- Date: Fri, 29 Aug 2014 14:59:25 -0000 From: whonixqubes(a)mail2tor.com To: tor-talk(a)lists.torproject.org Subject: [tor-talk] New Announcement: Qubes + Whonix is now available! Message-ID: <070faaa2512fca0b48fd5427127ef917.squirrel(a)mail2tor2zyjdctd.onion> User-Agent: SquirrelMail/1.4.23 [SVN] Reply-To: tor-talk(a)lists.torproject.org For those interested in Tor, Security, Qubes, Whonix, etc... With the help of several kind people in the Whonix & Qubes communities, I have successfully integrated the Qubes + Whonix operating systems together. For those who would prefer Whonix as an alternative to TorVM in Qubes (for torifying your VM traffic), this option is now available to you. This initial Qubes + Whonix configuration is achived using current versions: - Qubes R2rc2 & Whonix 8.2 Qubes + Whonix currently exists as a customized dual HVM configuration: - Whonix-Gateway HVM + Whonix-Workstation HVM A simple networking setup for Qubes + Whonix would look like: - NetVM <- FirewallVM <- Whonix-Gateway <- Whonix-Workstation Where, for example, the Whonix-Gateway conceptually replaces TorVM as your Tor ProxyVM, and Whonix-Workstation conceptually replaces your standard AppVMs (AnonVMs). You can get the Qubes + Whonix step-by-step instructions and more info here: https://www.whonix.org/wiki/Qubes All suggestions and feedback are welcome! I look forward to helping make Qubes + Whonix integration even tighter and more seamless throughout the future. If you're interested in the future growth of the Qubes + Whonix platform, then please join in with us to actively further this goal. For example, when ProxyVM support is added to the Qubes Debian Template, we can take Qubes + Whonix beyond the current HVM limitation and utilize a naitive ProxyVM + AppVM setup for Whonix. Thank you again to everyone who helped me bring the first known successful Qubes + Whonix configuration to the world... Patrick, Joanna, Marek, Jason, Axon, cprise, and everyone else who has helped! Thank you! :) P.S. Qubes + Whonix 9 support is coming soon! -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message -----

1 0

Re: Columbia XRay web transparency project
by Subrosa.io 27 Aug '14

27 Aug '14

It would be useful for XRay to also attempt to counter information gathering by executing random, low-volume queries in the background. This is one of the only countermeasures to data mining, and when done responsibly (ie, low volume) it should still be able to have a significant effect on decreasing the accuracy and utility of the mined results without irresponsibly hogging resources.

1 0

I made a site to test SHA-1 vs SHA-2
by Eric Mill 25 Aug '14

25 Aug '14

Feedback welcome on the site, copy, and methods: https://shaaaaaaaaaaaaa.com I'm taking bug reports and requests on GitHub: https://github.com/konklone/shaaaaaaaaaaaaa/issues/ -- Eric -- konklone.com | @konklone <https://twitter.com/konklone>

1 0

Columbia XRay web transparency project
by Gregory Foster 23 Aug '14

23 Aug '14

https://github.com/matlecu/xray > XRay is a research project from Columbia University that aims to improve transparency of data usage on the web. You can learn more on our website. http://xray.cs.columbia.edu/ > ...we developed XRay, a new tool that reveals which data in a web account, such as emails, searches, or viewed products, are being used to target which outputs, such as ads, recommended products, or prices. It can increase end-user awareness about what the services they use do with their data, and it can enable auditors and watchdogs with the necessary tools to keep the Web in check. > > Currently, XRay can reveal some forms of targeting for Gmail ads, Amazon product recommendations, and YouTube video recommendations. However, XRay's core mechanisms are largely service-agnostic, providing the necessary building blocks that we hope will enable a new generation of auditing tools that will help lift the curtain on how users' personal data is being used. > > Using our XRay Gmail prototype, we found some pretty interesting examples of data uses, such as a number of ads targeting depression, cancer, and other illnesses. We also saw quite a few subprime loan ads for used cars that targeted debt, loan, or borrow keywords in users' inboxes. YouTube (Aug 20) - "XRay: web transparency tool": https://www.youtube.com/watch?v=VxH20ey2d7k HT @kdnuggets: https://twitter.com/kdnuggets/status/503198576798089216 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

Gyroscope not only eavesdrop but also power line hack via VLF
by bluelotus＠openmailbox.org 21 Aug '14

21 Aug '14

http://www.reddit.com/r/badBIOS/comments/2e3yuv/badbios_transmits_ultrasoun…

1 0

New end to end encrypted IM/VOIP web app focused on ease of use
by Subrosa Team 21 Aug '14

21 Aug '14

Subrosa is an open source, end to end encrypted messaging / VOIP app focused on being easy to use for the general public. We made Subrosa in response to the mass surveillance revelations programs, and to address the difficulty of current tools for the average user. Oh, and it supports group video chats. Site, and hosted version to try it out: https://subrosa.io Why make something new? We've tried getting our non-techie contacts to use GPG/OTR/etc. Our personal experiences are that spending hours per person we want to talk to, teaching them how to use the tool, and helping them when they inevitably come across an issue (e.g. lose their keys) are just not practical. We think there's a place for an end to end encrypted messaging platform usable by *everyone*. Furthermore, not everyone cares about crypto. Subrosa is just as easy to use as making a Skype account, while key generation, etc are all performed behind the scenes. For end to end encryption to be widely adopted, it needs to convince people who don't care about it as well. And that means it can't be any harder, or more confusing than popular offerings. Subrosa does cryptography transparently, however we don't *hide* information such as fingerprints (so you can verify you're not being MITM attacked, by us). RSA keypairs are stored on our servers, with the private key being passed through PBKDF2 with the user password (not sent). Messages are encrypted using exchanged AES keys, with VOIP/video chats encrypted with SRTP. We know web crypto, when executing code from a remote server, has grave security implications. For ease of use, we do have a hosted version. Subrosa's client is fully open source however, and you can (and should!) run a local copy of the client. We use the ForgeJS library. http://github.com/subrosa-io/subrosa-client We're also fully committed to end to end encryption. We don't have any "gotchas" like iMessage being end to end for delivery, but storing the plaintext of messages in iCloud. We shouldn't have the ability to read any messages, in all circumstances (assuming local client). Please let us know what you think about Subrosa, and pick at this :)

7 9