- cypherpunks - lists.cpunks.org

Re: Re: [cryptography] Question About Best Practices for Personal File Encryption
by stef 16 Aug '14

16 Aug '14

On Sat, Aug 16, 2014 at 06:26:28PM -0500, Mark Thomas wrote: > Am I on the right track? If so does anyone know of a helpful guide to get started with OpenSSL on the command line besides the man pages? last time i checked openssl does no authenticated encryption on the command line. -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

1 0

Re: shipment interdiction [was: BadBIOS forensics]
by coderman 16 Aug '14

16 Aug '14

On Sat, Jul 19, 2014 at 5:20 PM, Bryan Starbuck <bryan(a)thestarbucks.com> wrote: > I like buying a computer in a surprise visit to an apple store or a store > that sells windows computers. agreed; on site ad-hoc cash purchases the best procurement technique. not infallible by any means, but at least avoids some known problems like this amusing scenario. (shipments from the Seattle Amazon warehouse to Kansas before delivery to Oregon was also funny.) repeat for emphasis: - keep chain of custody of sensitive hardware at all times - never procure or ship through mail. at one point, priority same day air would get a pass, but even this no longer suitable. best regards,

3 3

Interdiction of MIPS tablet
by bluelotus＠openmailbox.org 16 Aug '14

16 Aug '14

Last week, I purchased a MIPS tablet on ebay and a rooted Nooks Tablet with CyanogenMod. Nooks was shipped priority mail and arrived yesterday. Nooks tablet: http://www.ebay.com/itm/291214398900?_trksid=p2059210.m2749.l2649&ssPageNam… tracking info: https://tools.usps.com/go/TrackConfirmAction?qtc_tLabels1=94055096999391405… MIPS tablet was shipped FedEx Smart Post. It was interdicted and being returned to shipper: MIPS tablet: http://www.ebay.com/itm/201145886170?_trksid=p2059210.m2749.l2649&ssPageNam… tracking info: https://www.fedex.com/fedextrack/html/index.html?tracknumbers=9797927122850… "Delivery exception" "Returning package to shipper. Incorrect address, unable to deliver - Returning package to shipper - Please contact shipper/merchant for details" I purchased a Nooks tablet solely because its OMAP4 CPU has mask ROM. http://www.reddit.com/r/Android/comments/2d8lni/mask_rom_prevents_bios_root… I purchased a MIPS tablet hoping BadBIOS doesn't infect MIPS and because MIPS hardware assisted virtualization is not as developed as ARM's Trustzone and Mobicore. I don't trust HAV. I wish local retailers sold them so I could have purchased them in person. I ordered a T5 Torx screwdriver to remove the screws in the Nook so I can air gap it. If the screws are glued, I will promptly sell or donate it. Another item that was apparently interdicted is media card reader. http://www.ebay.com/itm/281206663913?_trksid=p2059210.m2749.l2649&ssPageNam… I purchased it on 8/8/2014. Yet, post office does not give tracking information: https://tools.usps.com/go/TrackConfirmAction?qtc_tLabels1=92748999964015553… Hackers have repeatedly stolen my media card readers, opened up and broken my media card readers and broke the write protection switch on three Digital Intelligence media card write blockers. They attempt to force me to use flashdrives. They haven't broken the write protection switch on my Kanguru flashblu write blocker. For some reason, flashdrives are easier to flash firmware or infect than micro SD cards.

2 2

Interdiction of MIPS tablet
by bluelotus＠openmailbox.org 16 Aug '14

16 Aug '14

Thanks for the compliment. Sorry your tech packages have been interdicted. http://www.reddit.com/r/badBIOS/comments/2bfgxi/updated_definition_of_air_g… http://www.reddit.com/r/badBIOS/comments/24diso/photos_of_piezo_electric_tw… My only witty thread: http://www.reddit.com/r/badBIOS/comments/2d6dp5/diy_how_to_destroy_bios_chi… On 08/15/2014 6:24 pm, Sam Gordon wrote: > Could you go into more detail by what you mean by air-gapping? The > removal of wireless equipment, destruction of ports, etc -- or > something entirely different? > > I find your posts interesting, and have experienced re-routed tech > packages myself. > > Thanks, > Sam

1 0

Some History
by Ryan Carboni 14 Aug '14

14 Aug '14

http://www.yak.net/surfpunk/issues/0105 >The FBI and the Justice Department say the initiative would > >not expand their power, but would ensure access to the type of > >communications they have been entitled to tap for years. > > > This is totally bogus. > > The FBI has never had the right to watch computer programs > execute. Now that computer programs are being written as > distributed systems, what was originally written to be an > internal subroutine call can look like a message over the > phone system. > > The FBI never had the right to bug corporate conference rooms. > Now that companies are using videoconferencing, a private > corporate conference could look like a phone call. > > Etc. > > This needs to be fought. > > - Carl > > >

1 0

Ukraine passed the bill about sanctions in first reading, it give power to close media, websites, and more
by Anton Nesterov 14 Aug '14

14 Aug '14

It includes many types of sanctions, but most interesting is that ones: 9) the prohibition or restriction of the retransmission of television and radio channels; 10) the prohibition to use radio frequency resource of Ukraine; 11) the restriction or termination of the media or other information activities, including those in the Internet; 12) the restriction or prohibition of production or distribution of printed materials and other information materials; 24) the prohibition of political parties, movements and other civil society associations and foundations; So if that bill will be passed, National Security and Defense Council can ban any foreign media, website, foundation, movement, printed material, etc. without court. http://osvita.mediasapiens.ua/material/33612 news report (in Ukrainian) http://w1.c1.rada.gov.ua/pls/zweb2/webproc4_1?pf3511=51915 text (in Ukrainian)

1 1

Shipment Interdiction
by bluelotus＠openmailbox.org 14 Aug '14

14 Aug '14

The package was not interdicted to Sarasota, Florida. It was interdicted from Sarasota, Florida. Three times! Where is it now? I purchased a Toshiba Portege R205 from an Ebay seller. I needed an ultraportable laptop pre2008 as explained in: http://www.reddit.com/r/privacy/comments/2cu80z/former_m15_officer_and_whis… I commuted 11 hours to Sarasota, Florida to personally pick up the laptop. Prior computers I purchased from Ebay and retailers were indicted, implanted and infected. See http://www.reddit.com/r/techsupport/comments/2a24sh/removing_bulldozer_impl… That night, I disassembled, air gapped, reassembled my laptop. I glued four screws on the back to attempt to prevent it from being disassembled and implanted. That night, hackers broke into my hotel room while I was sleeping. They drilled out the glued screws, implanted, physically damaged the keyboard and infected. On Saturday, July 19, 2014, I dropped off my Toshiba, along with an interdicted and tampered Fedora CD, infected flashdrive and an infected raspberry pi to a FedEx authorized reseller in downtown Sarasota. FedEx's policy is not to notify the shipper and the recipient of the redirection. I asked Michael how recipients are allowed to change the address without the consent or knowledge of the shipper. I explained that when I was the recipient and wanted to change the address, FedEx instructed me to ask the shipper to change the address. Michael explained that I had not placed restrictions on my account to prevent the shipping address from being redirected. Michael instructed me to ask the Revenue Department to do so. I asked an employee for the number of the Revenue Department. Employee refused to look up the number and misrepresented the Revenue Department did not have a direct phone number. Instead, the employee transferred me. The Revenue Department employee did not know their direct phone number. I hung up. I called back 800-463-3339 and again asked for the Revenue Department's telephone number. I was finally given 800-622-1147. I asked an employee in the Revenue Department to transfer me to a supervisor. However, I was transferred to Bobby in Customers Relations. I asked Bobby to transfer me to a supervisor in the Revenue Department. Bobby misrepresented that she is a supervisor in the Revenue Department. I asked Bobbie for her contact information in the event that I needed to contact her again. Bobbie misrepresented her contact information is BRIFTOC. Bobby failed to give her ID number. I asked Bobby why I was not offered restriction options when I set up my account. Nor was I notified of restrictions options there after until today. Bobby did not give an answer. I asked Bobby to place restrictions on my account prohibiting redirecting the shipping address without my knowledge and consent. I asked Bobby to escalate my complaint. Bobby wanted me to write a letter to FedEx. There is no point spending the time and money on my prepaid phone to call Fedex, if I have to write a letter, print it out and mail it. I insisted Bobby write up a complaint. Bobby did not give me a case number. I asked Bobby to email or fax the complaint to me. Bobby said she could not email or fax. Interdiction #2: Michael informed me that morning the package was being returned to me because the recipient had not picked it up at the FedEx location in Beaverton, Oregon. The hackers' timing was perfect. Since I am being hacked in real time, the hackers knew that I logged into my FedEx account. FedEx holds packages for pick up for five business days. Yet, FedEx held the package much longer. All of a sudden, FedEx is returning it to shipper. I had departed Sarasota, FL. Returning it to Sarasota, FL would have placed the package at risk. FedEx should notify shippers and recipients before packages are being returned to shipper. Michael promised to have the package delivered to the initial address. Michael left a voicemail confirming that the package was being redirected to the initial address. Interdiction #3: I did not know Coderman's phone number so I gave my phone number on the ground shipping label. On August 5, 2014, I received an automated voicemail that the package will be delivered tomorrow, that a signature is required and a recommendation to chose the option hold for pick up. I had not requested a signature. Nor did the tracking information display that a signature was required. A signature requirement can be used as an alibi to return a package to the shipper if the recipient is not home and does not make arrangements to sign for the package. I tried to reach Bobby but Carolyn ID 921550 did not even try to transfer me to Bobby. Customer Relations' direct telephone number should be given to customers. Supervisors should be able to give out extension numbers. Instead Carolyn transferred me to a female employee in El Paso. It took her a while to read the notes on my account to find out who Bobby is. Bobby had left for the day. I asked to speak to a supervisor. She told me supervisors left for the day. I asked what the supervisors' hours are. She refused to tell me. She told me a signature was not required. Interdiction #4: She informed me the package was being returned to FedEx Office in Beaverton, Oregon. Again, I asked to speak to a supervisor. She transferred me to Carlos ID 892831. Carlos confirmed that signature was not required and that package was being returned to FedEx Office in Beaverton, Oregon. Carlos could not explain why the package was redirected again to FedEx Office. I asked how the redirections were being requested. Carlos explained the recipient went on FedEx's website. I argued that the recipient had not requested redirections. Carlos argued no one else would know the tracking number and recipient's contact information. I requested an investigation on the identity of the person performing the redirections. I asked Carlos how the shipment was again redirected without my knowledge or consent. I explained to Carlos that Bobby had placed restrictions on my account prohibiting redirection. Carlos explained that Bobby does not place restrictions on accounts. That Bobby could only forward my request for restrictions. I should never have been transferred to Bobby. when I argued with Bobby that she was not the appropriate employee to be transferred to, Bobby should have transferred me to an employee who can place restrictions. I complained to Carlos that shippers and recipients should be notified when shipments are redirected. The next day, August 6, 2014, I received email notification that the package was delivered to FedEx Office in Beaverton, OR. I asked to speak to Bobbie, Michael and Carlos. They were not available. An employee told me the package was delivered to the initial address. Was it? I emailed Coderman several times and am waiting for his reply. FedEx should have a fax number or an email address to forward complaints to. Instead, FedEx merely offers an online form to fill out. The form has a size restriction. I could not copy and paste this complaint into its form. On August 6, 2014, I mailed a complaint requesting FedEx to email or fax their investigation, confirmation that restrictions has been placed on my account and to waive the shipping fee. To date, FedEx has not responded.

3 2

[Cryptography] miniLock seems pretty interesting
by Eugen Leitl 13 Aug '14

13 Aug '14

----- Forwarded message from Eric Mill <eric(a)konklone.com> ----- Date: Mon, 21 Jul 2014 09:48:32 -0400 From: Eric Mill <eric(a)konklone.com> To: "cryptography(a)metzdowd.com List" <cryptography(a)metzdowd.com> Subject: [Cryptography] miniLock seems pretty interesting Message-ID: <CANBOYLVg=Dndusthy82zbksDwyVupdHU9BaSL1mE6199FbvmYQ(a)mail.gmail.com> I saw this announced at HOPE X this weekend: http://minilock.io/ It uses curve25519 <http://cr.yp.to/ecdh.html>, which requires much smaller keys (32 or 64 bits) to ensure security -- and so it basically just demands a strong passphrase from the user from which can be derived a strong private key. The developer has a video <http://vimeo.com/101237413> and slides <http://minilock.io/files/HOPEX.pdf> to go along with it, and in general focused his energy on persuading the audience that JavaScript crypto is a necessary and achievable part of the future. -- Eric -- konklone.com | @konklone <https://twitter.com/konklone> _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

4 5

A post-spy world
by John Young 13 Aug '14

13 Aug '14

"We are moving toward a post-spy world, according to the guy that runs the CIA's venture capital arm." <http://t.co/5eYfbRYU8k>http://www.defenseone.com/technology/2014/08/10-ways-make-internet-safe-cyb…

6 6

DropItLike
by coderman 13 Aug '14

13 Aug '14

https://github.com/mozilla/DropItLike

3 2