- cypherpunks - lists.cpunks.org

Columbia XRay web transparency project
by Gregory Foster 23 Aug '14

23 Aug '14

https://github.com/matlecu/xray > XRay is a research project from Columbia University that aims to improve transparency of data usage on the web. You can learn more on our website. http://xray.cs.columbia.edu/ > ...we developed XRay, a new tool that reveals which data in a web account, such as emails, searches, or viewed products, are being used to target which outputs, such as ads, recommended products, or prices. It can increase end-user awareness about what the services they use do with their data, and it can enable auditors and watchdogs with the necessary tools to keep the Web in check. > > Currently, XRay can reveal some forms of targeting for Gmail ads, Amazon product recommendations, and YouTube video recommendations. However, XRay's core mechanisms are largely service-agnostic, providing the necessary building blocks that we hope will enable a new generation of auditing tools that will help lift the curtain on how users' personal data is being used. > > Using our XRay Gmail prototype, we found some pretty interesting examples of data uses, such as a number of ads targeting depression, cancer, and other illnesses. We also saw quite a few subprime loan ads for used cars that targeted debt, loan, or borrow keywords in users' inboxes. YouTube (Aug 20) - "XRay: web transparency tool": https://www.youtube.com/watch?v=VxH20ey2d7k HT @kdnuggets: https://twitter.com/kdnuggets/status/503198576798089216 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 1

Gyroscope not only eavesdrop but also power line hack via VLF
by bluelotus＠openmailbox.org 21 Aug '14

21 Aug '14

http://www.reddit.com/r/badBIOS/comments/2e3yuv/badbios_transmits_ultrasoun…

1 0

New end to end encrypted IM/VOIP web app focused on ease of use
by Subrosa Team 21 Aug '14

21 Aug '14

Subrosa is an open source, end to end encrypted messaging / VOIP app focused on being easy to use for the general public. We made Subrosa in response to the mass surveillance revelations programs, and to address the difficulty of current tools for the average user. Oh, and it supports group video chats. Site, and hosted version to try it out: https://subrosa.io Why make something new? We've tried getting our non-techie contacts to use GPG/OTR/etc. Our personal experiences are that spending hours per person we want to talk to, teaching them how to use the tool, and helping them when they inevitably come across an issue (e.g. lose their keys) are just not practical. We think there's a place for an end to end encrypted messaging platform usable by *everyone*. Furthermore, not everyone cares about crypto. Subrosa is just as easy to use as making a Skype account, while key generation, etc are all performed behind the scenes. For end to end encryption to be widely adopted, it needs to convince people who don't care about it as well. And that means it can't be any harder, or more confusing than popular offerings. Subrosa does cryptography transparently, however we don't *hide* information such as fingerprints (so you can verify you're not being MITM attacked, by us). RSA keypairs are stored on our servers, with the private key being passed through PBKDF2 with the user password (not sent). Messages are encrypted using exchanged AES keys, with VOIP/video chats encrypted with SRTP. We know web crypto, when executing code from a remote server, has grave security implications. For ease of use, we do have a hosted version. Subrosa's client is fully open source however, and you can (and should!) run a local copy of the client. We use the ForgeJS library. http://github.com/subrosa-io/subrosa-client We're also fully committed to end to end encryption. We don't have any "gotchas" like iMessage being end to end for delivery, but storing the plaintext of messages in iCloud. We shouldn't have the ability to read any messages, in all circumstances (assuming local client). Please let us know what you think about Subrosa, and pick at this :)

7 9

Fwd: cpunk.us experiencing downtime
by Griffin Boyce 20 Aug '14

20 Aug '14

And xmpp user accounts were deleted in the process. See below: -------- Original Message -------- From: Cypher <cypher(a)cpunk.us> Sent: August 20, 2014 11:40:02 AM PDT To: liberationtech(a)lists.stanford.edu Subject: [liberationtech] Experiencing downtime Hello Everyone, Just wanted to let everyone know that the server that runs the Oklahoma anonymous remailer and the chat.cpunk.us XMPP service went down sometimes last night. Unfortunately, because a backup didn't fire off correctly, that also means that any accounts on chat.cpunk.us and all anonymous email in the mailq waiting to be delivered have been lost. I'll be working on getting a new server later tonight and we should be back up by 22:00 EST. If you had an XMPP account on chat.cpunk.us, you will need to recreate it after that time. Thanks for your patience, sorry for the inconvenience. Cypher -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. -- Sent from my tracking device. Please excuse brevity and cat photos.

1 0

Plausible deniability...
by J.R. Jones 20 Aug '14

20 Aug '14

So how do you all go about maintaining said deniability... Hidden volumes etc. Any way to use LUKS yet?

4 3

[Cryptography] GPU Farm
by Eugen Leitl 19 Aug '14

19 Aug '14

----- Forwarded message from Marco Streng <marco.streng(a)genesis-mining.com> ----- Date: Mon, 18 Aug 2014 18:26:49 +0200 From: Marco Streng <marco.streng(a)genesis-mining.com> To: cryptography(a)metzdowd.com Subject: [Cryptography] GPU Farm Message-ID: <53F22949.5020909(a)genesis-mining.com> User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 Hello Guys from metzdowd, I really like your mailing list and following it longer time now. Since I think the posts there are really of high quality and the people participating really know what they are talking about I would love to ask a specific question that could be really interesting for everyone there. I come from a company that is doing cryptocurrency mining in large scale and currently we are thinking about a use case for our 1300 high end GPU farm that is not necessarily profit oriented, but most importantly interesting and exciting. I asked a lot of people till now and also people from chaos computer club in germany, where I received especially ideas pointing to using the farm to decrypt emails or other decryption services. Also I was suggested to use it to decrypt the NSA_KEY, but that is obviously not doable in human time even if the farm would be 1000x bigger. Do you have any interesting idea what to do with the farm? If we like the project it we wouldn't hesitate to start directly! I would really appreciate if you could ask this to the mailing list and I am really excited about the answers. What do you think? Greetings, Marco -- Marco Streng www.genesis-mining.com CEO & Co Founder +491602482228 _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message -----

3 2

Gyroscopes in Android phones can be turned into always-on microphones
by Gutem 19 Aug '14

19 Aug '14

FYI: http://www.geek.com/android/gyroscopes-in-android-phones-can-be-turned-into…

4 4

How does the Hacking Team network malware work? How bad is it?
by Eric Mill 17 Aug '14

17 Aug '14

Hi, I've read the Intercept's writeup[1], and read through Citizen Lab's writeup[2]. I'm having trouble understanding the attack surface, and how widely applicable the vulnerability is. Are MS and Google targeted because of their ubiquity, or is there also something (besides not using HTTPS) that they did to make their services vulnerable? How can there be a remote code vulnerability so low in the stack that it can be injected at the packet level, but high enough that TLS encryption foils the attack? Does this affect Windows only? Through particular browsers? I'm certainly up for using this as an argument for how difficult it is to predict the severity and creativity of MITM attacks, but I would like to better understand the magnitude of the disclosure. Thanks, Eric [1] https://firstlook.org/theintercept/2014/08/15/cat-video-hack/ [2] https://citizenlab.org/2014/08/cat-video-and-the-death-of-clear-text/ -- https://konklone.com | https://twitter.com/konklone

2 1

Re: [cryptography] Question About Best Practices for Personal File Encryption
by Christopher Nielsen 17 Aug '14

17 Aug '14

On Aug 15, 2014 11:06 PM, "Mark Thomas" <mark00thomas(a)gmail.com> wrote: > > I have a question for the group, if I may ask it here and in this manner (?). > > What are you guys using to encrypt individual files and folders or even entire drives like a USB? > > I am thinking that: > > 1. any commercial product could be compromised and not completely secure. Like Apple’s FileVault2, which Apple has a key to. The comment about Apple is simply false. Apple does not have a key to FileVault2 unless you escrow your key with them. I know this because a dear friend recently passed, and his family was not able to gain access to his encrypted drives through Apple. That said, FileVault2 is susceptible to offline dictionary attacks on the password, or if you can get access while the drive is online, there are attacks on the Keychain. > 2. It is probably open source. What makes you think open source will save you? All the eyeballs looking at the code? That was proven a false sense of security when heartbleed was announced. > 3. It is probably implemented with the command line. > > Am I on the right track? If so does anyone know of a helpful guide to get started with OpenSSL on the command line besides the man pages? > > Regards, > > Mark > _______________________________________________ > cryptography mailing list >cryptography(a)randombit.net >http://lists.randombit.net/mailman/listinfo/cryptography

4 3

Re: [cryptography] Question About Best Practices for Personal File Encryption
by Tony Arcieri 17 Aug '14

17 Aug '14

On Fri, Aug 15, 2014 at 9:05 PM, Mark Thomas <mark00thomas(a)gmail.com> wrote: > any commercial product could be compromised and not completely secure. > Like Apple’s FileVault2, which Apple has a key to. There aren't known backdoors in FileVault2, or for that mater, Microsoft's Bitlocker. Apple, on the other hand, has been pretty forthcoming with law enforcement backdoors in iPhones (which, actually, seem fairly reasonable, IMO) Don't trust their encrypted filesystem? You better not trust the OS either, for that surely has access to all of the encryption keys you've ever put in main memory. tl;dr: if you don't trust proprietary encrypted filesystems, you better not trust the proprietary OSes they're built into either. -- Tony Arcieri

1 0