- cypherpunks - lists.cpunks.org

Apple says ending unlocking practice for LEA/users with ios8
by grarpamp 19 Sep '14

19 Sep '14

Apple will no longer unlock most iPhones, iPads for police, even with search warrants http://www.washingtonpost.com/business/technology/2014/09/17/2612af58-3ed2-…

3 4

compiling bleep
by Randolph 19 Sep '14

19 Sep '14

Hi Grarpamp, the point was that I would not use bleep messenger from bittorrent, as it is not open source. Others like the one you did a research on might be worth for further testings, either by the binaries or - you seem to be keen on to - compile it yourself. I cannot help you with compile firefloo messenger on linux or windows, as I have not done this yet. Why don' t you test the binaries? The source and the binaries might not be machting from hash, because if you know source projects, the source might be corrected on one or two files even when the binaries have been build. So better build the software from source and use your own binaries. I would suggest to build the crypto core first, which is spot-on. Regards 1) I guess you use windows. 2a) download the source from either the download files https://sourceforge.net/projects/spot-on/files/Version%200.11/ File: Spot-On.d.tar.gz 2b) or use the SVN url to be current: https://sourceforge.net/p/spot-on/code/HEAD/tree/ svn checkout svn://svn.code.sf.net/p/spot-on/code/ spot-on-code 3) install Qt.io Use Version 5.3.1 Qt 5.3.2 for Windows 32-bit (MinGW 4.8.2, OpenGL, 737 MB) http://download.qt-project.org/official_releases/qt/5.3/5.3.2/qt-opensource… configure it correctly 4a) use the comand line app from Qt and here you use these commands: https://sourceforge.net/p/spot-on/code/HEAD/tree/branches/0.12/Documentatio… Linux: qmake -o Makefile spot-on.pro Return make 4b) or use better the creator app from Qt. this is very convenient, so I describe this way further: Load the file "spot-on.win.qt5.pro" with the Creator. It is the .pro file for the kernel. Under windows it also loads the spot-on-gui.win.qt5.pro, which is the .pro file for the gui. (Under linux you might need to pic up both and compile both). 5) click the green forward icon to compile the pro file (for release and pro-gui), in the Creator. the compile runs and shows the app. 6.) Enter password, generate keys and connect to the project server in Neighbours tab: tulip.cloud.tilaa.com 4710 7) Ask a friend to do the same or to use the binaries: exchange keys, and chat. Done. All is encrypted and you never need to exchange keys. Hope this helps to use Qt. It is very easy. Regards 2014-09-19 13:37 GMT+02:00 grarpamp <grarpamp(a)gmail.com>: > If you are able to compile a binary > No, do not send it to me, send it to the list.

1 0

Bittorrent Bleep
by Александр 19 Sep '14

19 Sep '14

http://blog.bittorrent.com/2014/09/17/bittorrent-bleep-alpha-goes-public-in…

5 5

killing RC4 in Chrome
by coderman 19 Sep '14

19 Sep '14

https://twitter.com/grittygrease/status/512328703938797568 <grittygrease> Are you planning on dropping RC4 support in Chrome anytime soon? <sleevi_> Not until I can work with @mikewest to get our mixed content detection improved and get @__apf__ on board for more sec-ui :)

6 7

Re: Re: [cryptography] Email encryption for the wider public
by stef 18 Sep '14

18 Sep '14

On Thu, Sep 18, 2014 at 09:06:53AM +0200, Henry Augustus Chamberlain wrote: > currently able to use email encryption at all! I think both concerns > are fair, and both are worth trying to solve. let me summarize (and ask you to reread and understand) grapamps response to you: email is dead. -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

2 1

Re: Re: [cryptography] Email encryption for the wider public
by stef 18 Sep '14

18 Sep '14

On Thu, Sep 18, 2014 at 11:13:04AM +0200, Krisztián Pintér wrote: > On Thu, Sep 18, 2014 at 10:57 AM, stef <s(a)ctrlc.hu> wrote: > > let me summarize (and ask you to reread and understand) grapamps response to > > you: email is dead. > > email is not dead, it is a zombie that walks around for at least 20 > years. i like your analogy :) is there a non-zero probability that zombie analogies are the opposite to car analogies? -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

2 2

Re: [tor-talk] wake up tor devs
by grarpamp 17 Sep '14

17 Sep '14

On Wed, Sep 17, 2014 at 5:04 PM, <BM-2cUqBqHFVDHuY34ZcpL3PNgkpLUEEer8ev(a)bitmessage.ch> wrote: > Why is Tor wasting time in implementing secure hidden services? Why not > copy from here if they are doing it right: > > Tor I2P > Cell Message > Circuit Tunnel > ... > > Why not distributed directory authorities and hardcoded? > Why not secure tunnels independent of guards? > Or does Tor want to remain less secure? Yes, there should be more comparative analysis of approaches amongst all the current networks. Create a dedicated group that publishes such things on a darknet wiki. Hold not just project specific meetups as is done today, but genuine summits amongst all such projects that puts their specific projects aside and determines what models might best suit the next 10-20 years. Determine whether the community is too chained by legacy project/product entrenchment to adopt new better approaches that have come up in research since they themselves started their own projects. Find any worthy new techniques and peel off interested developers into new projects. Try to ensure that big well known projects aren't soaking up all the fanfare/funds when equally valid small projects, or new projects would benefit the world the same or more than the gorilla in the room. For example, there seems some merit in filling your internode links with chaff padding up to the bandwidth limit you configure in order to mask both when and how much you are communicating. But it does not seem any project is doing that? Perhaps because chaff transmission/management/security models are not well developed. Or just the 'woah, bandwidth' reaction, which in reality of the simplest design only affects you and what bw you were willing to purchase or experience anyway (as when operating under a non-chaff network with a given/high utilisation condition). Another example... there was, or is, at least one group accepting funds and then running some of the various overlays equally at once... tor, i2p, freenet, cjdns, mailmix. Take some time to step back and see what together you can do with the big picture in all areas... research, development, operations, marketing.

1 0

Re: [cryptography] Email encryption for the wider public
by grarpamp 17 Sep '14

17 Sep '14

On Wed, Sep 17, 2014 at 9:43 AM, Henry Augustus Chamberlain <henryaugustuschamberlain(a)gmail.com> wrote: > I propose that we use the local part of the email address to store the public key, > ... > my email address would be (64 random letters)(a)gmail.com > ... > Somebody not using encrypted emails could still click on your "mailto" > link and send you an email, although it will be unencrypted Putting keys into some_encoding(a)example.com might cover some bases related to offline key lookup and message validation. Most user and system mail tools would need changes to handle string width and keytype, addressbooks updated, etc. Totally burying OpenPGP, passphrase and key lookup/use behind a fully integrated MUA GUI for grandma would work just as similarly well right now today with no such encoding. But in the end, all you're doing is covering the message body, and in today's world that's clearly not enough. No one's yet solving the huge issues with leaving mail exposed to what is essentially open-for-all-to-inspect central storage and mail routing. The "who's IP talking to who", "From To Subject, daemon headers, etc" metadata, when, how much/often, provider logs, someone sending you unencrypted mail, you giving up your private keys to the provider or running blobs they provide to you, etc. This is all unfixable with traditional "Email" models. This is why that to really solve anything more than the message body, you need to go completely nextgen and turn that 'email address' into an anonymous P2P overlay network node address, run your overlay client [which supplies a mail/messaging front end] and send/receive mail through that from/to your usual MTA/MUA/messaging toolchain. The real work there is in pushing the P2P node count up... - Research how many users globally might leave their messaging node up 24x7 for a direct realtime overlay connection with the far end "user@node"... 1/10/100/n*1000 million? - Develop message storage [and forward/poll/expiry] within the overlay for those that aren't in online mode. - Determine any hardware limitations and thin client models. There is an ongoing thread with the subject "The next gen P2P secure email solution" that contains various people's initial thoughts/framework on this.

1 0

Giganews Is an FBI operation - Giganews Denial Campaign Overdrive
by coderman 17 Sep '14

17 Sep '14

i thought the TAO catalog would be most volatile, but maybe Giganews Golden Frog debacle will take it... cryptome must be a hot seat! cool jya's buns with some bitcoin... [ http://cryptome.org/donations.htm ] :P best regards, --- http://cryptome.org/2014/09/giganews-denial.htm 16 September 2014 Giganews Denial Campaign Orchestrated PR against every leaker is to demonize: call the leaker a sad case who needs psychiatric help, whose life style is scrutinized for damning behavior aided by fabricated ruses and testimonies against the leaker. Officials, CEOs, lawyers, co-workers are set in motion to slur, ridicule, laugh at, scowl at, condemn, smear, pity and rage against the leaker. Retractions and redactions are demanded to protect he innocent. But never admit the truth of the leaks until after more leaks, then grudingly, with shallow apologies, layer by layer as the leaking continues. Attacks are initiated on the leaker's outlets and supporters, accusing them of being duped and hoaxed, demand that they too recant and admit being taken in by a crafty operator who did not understand the full picture, and was not a reliable worker. This is the pattern of cover-up, and it is widespread among malefactors working the same territory of duping the public on behalf of the government, usually after themselves being entrapped by officials and extorted into becoming informers and co-conspirators with officials. And if all goes well handsome contracts are used to cement the malefaction as a part of successful business of betrayal. This is what Nick Caputo revealed of Giganews, this is what Giganews must deny as formulaicly denied by Stratfor, by HG Gary, by Sabu, by Google, by Microsoft, by NSA, by DoJ, by FBI, on and on. --- http://cryptome.org/2014/09/giganews-fbi.htm 15 September 2014 Giganews Is an FBI operation Cryptome, Let me explain my history at Giganews in Austin, Texas and how I learned about the FBI connection. I used to be a huge fan of Usenet and a customer of different newsgroup providers for several years, and I started working at Giganews in 2009. I rose through the company, being promoted to a system technician after 6 months, and became a Giganews system engineer less than two years after that. A huge pirate at the time, I loved the idea of helping people download all the "rich multimedia content" they could. The porn content is not safe on Usenet, and the groups with children being abused I find abhorrent. Customers would write in about it all the time, so its no secret to a Usenet employee where it is. Data Foundry is a data center company which is interconnected to Giganews with the same admins, nocs, etc. Their main office headquarters is at 1044 Liberty Park Dr in Austin. But, they host most of the Usenet content in other data centers around the world. While talking to the CEO of the entire operation, Ron Yokubaitis, I heard what I interpreted as his request to remove the child pornography groups when he asked, "Would you delete child porn?" I honestly loved the thought of removing that junk off of Usenet, and removed three cp newsgroups soon afterwards. This happened December 11th, 2011. I didn't remove anything related to the normal and more socially acceptable content Usenet downloaders know about. It turned out that that wasn't what the CEO really wanted, who then claimed he forgot what he said. The Giganews/Data Foundry admins Philip Molter and Mike Smith disciplined me for removing the child porn groups and didn't trust me to keep working there afterwards. They made subtle references to jeopardizing criminal investigations IN PROGRESS then threatened me with a bad reference for removing the child abuse junk. No big deal, a bad reference from them after doing that is good, but Philip restored the cp content from a backup I didn't have access to. Fast forward several months, I turned into a traitor in an effort to remove the abhorrent junk off Usenet - I broke the first and second rules not to talk about it, and told the FBI the truth about the child abuse groups deletion in an email. This probably wont go over well with internet freedom lovers, but sharing what I learned in the experience will, I promise. My seemingly traitorous act exposed the real traitor, the biggest one, to the Usenet network. The FBI invited me to their unlisted Austin office in a nondescript office building at 12515 Research Blvd, Building 7, Suite 400 in late October 2012. Two agents took notes on what I told them, then something unexpected happened. Special Agent Scott Kibbey told me he personally knew the Giganews / Data Foundry CEO, bragged to me about working there, then invited me back to Giganews! I had also helped them with a separate crime venue in Austin that Data Foundry was going to compete with, so I had earned their trust. In addition, Kibbey offered me a new name and identity, with a new drivers license and everything, if I were to go back to work at Giganews. It was then that I realized that the fed I was talking to had been my coworker at Giganews since I started in 2009! The other agent was actually an Austin police detective named Charles Riley helping the FBI whom worked alternate shifts to me at the Datafoundry NOC under alias. Riley even bragged about being a detective once at a shift change! The thought of my fellow Usenet systech in crime being a police detective was unthinkable at the time. I've included some of the emails from these feds (with email headers and IP addresses) in the link at end. Special Agent Scott Kibbey is central to the whole Giganews operation, including Data Foundry, but with different names. This agent is a top exec for Data Foundry, a top admin for Giganews, the Golden Frog front company run from the same Usenet servers for VyprVPN, and the other Usenet fronts Usenet.net, Supernews, Rhino Newsgroups, and Powerusenet. Another business front name they used when I was there is Powerhouse Management. Kibbey rolled out the OS images, kernels, patches, setup the entire VyprVPN service including the detailed logging which is easily accessible to him and the other government agents working there. There were also rumors agents from other governments worked thereÂ The Hong Kong Giganews servers were brought down in early June 2009 by a Chinese employee, the day of the Tiananmen Square anniversary when the Chinese government was blocking everything online. This means the VyprVPN connecting IP addresses are accessible to the Chinese government indirectly through this employee. Anyone using the VyprVPN service that governments are targeting is in danger, honestly. This is my warning - that all of the content being downloaded and shared on the Usenet network is going through the authorities! Giganews customers are being logged! The log file is called the "gigauth" on their "cruncher" servers which logs every connection by every customer, which are then archived. This means Usenet uploaders are helping the feds monitor the distribution of Usenet content if their newsgroup provider peers with Giganews! I swear to you that Giganews is an operation that employs federal agents who run most of the operation. I suggest demanding from your newsgroup provider that they stop the peering of binary groups to FBI's Giganews. Please understand how risky this is for me to explain as Agent Kibbey subtly threatened my family on behalf of Data Foundry the second time I met both agents at the Austin FBI office. The traitors saw me as a threat and said I did not cooperate. Even with this threat, please warn Giganews customers and other Usenet users, and use the evidence I've linked. If the google drive link dies, email me for a new one. Agents Kibbey and Riley did not let me photograph them, but I did include a scan of their business cards. Riley didn't have an FBI badge or card, but he had an fbi.gov email address, ip, and Austin Police Department badge. I've linked pictures of my Giganews badge and the shirts with their red armor logo I was forced to wear when working there. I've also linked to the Giganews/Data Foundry employee list with in-office mug shots, phone numbers and emails they gave me. I did not agree to return this on their employee paperwork, so it is not illegal to share. They thought I did, though. I doubt the names and phone numbers they used internally are all real, as many are likely aliases and fed-routed voip proxies. Most of the emails changed to goldenfrog.com before I left from the ones listed in the 2011 employee pdf. Some of the mugshots are photoshopped by them, as the pictures did not match the physical appearance of some, likely to hide in case of someone like me exposing these traitors. Feel free to upload this to any newsgroup that Giganews carries - Their customers need to know. -Nick Caputo

2 1

PFS is a global, versioned, peer-to-peer filesystem
by Eugen Leitl 17 Sep '14

17 Sep '14

http://ipfs.io/ IPFS is a global, versioned, peer-to-peer filesystem. It combines good ideas from Git, BitTorrent, Kademlia, SFS, and the Web. It is like a single bittorrent swarm, exchanging git objects. IPFS provides an interface as simple as the HTTP web, but with permanence built in. You can also mount the world at /ipfs. How does it work? Read the paper http://static.benet.ai/t/ipfs.pdf

1 0