- cypherpunks - lists.cpunks.org

Re: HTML on-list messages, top-posting
by shelley＠misanthropia.info 08 Jan '14

08 Jan '14

On Wed, Jan 8, 2014, at 02:35 PM, staticsafe wrote: (snip) > > Most mailing lists I've encountered do not mess with the reply-to > header. cryptome & libtech do (just two I can think of right off) Btw: yes, I hate html on lists too. Will try not to reply using my shitty mobile email client when I'm away from real email!

1 0

HTML on-list messages, top-posting
by rysiek 08 Jan '14

08 Jan '14

Hi there, since we're already deep into Usenet territory, I'll just leave this message here and see what happens. -- Pozdr rysiek

3 6

Re: [cryptography] To Protect and Infect Slides (addenda)
by brian carroll 08 Jan '14

08 Jan '14

context: forgot to mention overriding hypothesis that state of insecure crypto - as with nukes - may be price of peace for cold war reunification in improved framework, thus structural duplicity has wider impact than inside states alone, could also bridge state-state secure relations in parallel with those that are insecure, allowing for advanced governing relations; in this way, broken crypto could represent deeper truth of the inside condition than what is able to be written about, yet exists as consciousness for those in the industry, etc, given what perspective, parameters, values, in the deception On Wed, Jan 8, 2014 at 11:45 AM, <dan(a)geer.org> wrote: > > > 5) another realization upon hearing the 30c3 talk of Jacob Appelbaum > > was the 'earth firewall' then indicates that the NSA controls the > internet, > > and that it is not operating as a subset within it, and instead > everything > > that occurs is within its domain.... > > The Internet is not controlled, i.e., there is a power vacuum > that will soon be filled. There are many, many players and soon > to be more. The question to be contemplated, if any, is this: > Do you prefer that the competing claims of control over the > Internet be resolved by way of (1) dramatic Balkanization or > by way of (2) making the Internet an organ of world government? > > A thought experiment, if needing one: is VoIP a part of the > Internet or is it not, that is do you have two networks in your > home/office or one? > > --dan > >

1 0

Re: [cryptography] To Protect and Infect Slides
by Jacob Appelbaum 08 Jan '14

08 Jan '14

Kevin W. Wall: > On Tue, Dec 31, 2013 at 3:10 PM, John Young <jya(a)pipeline.com> wrote: > >> 30c3 slides from Jacob Appelbaum: >> >> http://cryptome.org/2013/12/appelbaum-30c3.pdf (3.8MB) >> > > And you can find his actual prez here: > <https://www.youtube.com/watch?v=b0w36GAyZIA> > > Worth the hour, although I'm sure your blood > pressure will go up a few points. > I'm also happy to answer questions in discussion form about the content of the talk and so on. I believe we've now released quite a lot of useful information that is deeply in the public interest. All the best, Jacob

5 7

Private Distributed Hash Tables
by Rich Jones 08 Jan '14

08 Jan '14

Far too much yap yap yappin' around here lately.. cpunks write code, remember? Let's get back to business. Here's an idea for a private, censorship-resistant communication/file sharing system with integrated invitations and access control. I don't think I've ever seen this before, but it's quite possible that people have discussed this idea previously. Either way, I don't know of any implementations yet. Problem ======= The current P2P file sharing landscape is divided up into two spaces: 1) private tracker communities (what.cd // Demonoid // etc) which provide high quality network speeds and file quality through moderation, but which are often subject to outages due to centralization, and 2) the single giant BitTorrent 'peer exchange' distributed hash table, which provides universal file access and fault-tolerance, but at the cost of abuse and surveillance of those participating. Ideally, we want a peer-to-peer community which is decentralized and fault-tolerant, but with enough authority to maintain a high network quality and private enough to avoid open surveillance. Proposed Solution ======= It might be possible to combine the exclusivity and moderation of private trackers with the fault-tolerance of distributed hash tables by having each private table operate with a certificated-authority based public key infrastructure. Essentially, to participate in the DHT, peers must cryptographically prove that they have been invited to participate. Power and trust flow down a through a concentric certificate web. A client's authority in the network is a function of how far away from the root authority they are (not dissimilar to Scientology's hierarchy.) Clients should automatically respect commands coming from those higher up the cert chain or from those closer to the root than they are, and should listen to, but not automatically respect, commands from those lower down the cert chain or from "lower-ranking" clients. * Bootstrapping and Invitation The very first user of the network will have to generate a root certificate. He is then able to generate new signing certificates, which he can give to new users of a network to allow them the ability to access the network. These new users should be able to use their own certificates to do the same for their own new users. (This could be done with certificate signing requests coming from potential new users as well, but that might come at the cost of a slightly more complicated user experience). * Revocation Bannings can be performed by issuing updates to a network-wide revocation list. Clients will automatically respect revocations coming from superiors, and may or may not choose to respect revocations coming from underlings. * Implementation Everything needed to create the heart of this should exist already in Kademlia and OpenSSL. BitTorrent could serve as the basis for the file-sharing application, but vanilla BitTorrent has a content discovery problem, so I'd suggest that any implementations of BitTorrent on Private Distributed Hash Tables should have some kind of discovery BEP included as well, possibly one which uses the authority system of the PDHT to verify files. There's also a possibility there for what you might call "trusted amnesia" - the ability for a user with a high authority to publish verified documents to the whole network without having to broadly expose themselves as the source of the content by having peers in their same trust level sign their content, forget the source, then increase the availability by one access level. Anyway, that's the sketch. Any thoughts? Rich

2 3

Stealing J. Edgar Hoover's secrets.
by Jim Bell 07 Jan '14

07 Jan '14

Just saw this on Yahoo. Seems appropriate to mention this, given Snowden, Manning, etc. http://screen.yahoo.com/new-york-times/stealing-j-edgar-hoover-secrets-1309…

2 1

Swartz, Weev & radical libertarian lexicon (Re: Jacob Appelbaum in Germany - Aaron Swartz)
by Jim Bell 07 Jan '14

07 Jan '14

From: Cari Machet <carimachet(a)gmail.com> To: rysiek <rysiek(a)hackerspace.pl> Cc: cypherpunks(a)cpunks.org Sent: Tuesday, January 7, 2014 10:29 AM Subject: Re: Swartz, Weev & radical libertarian lexicon (Re: Jacob Appelbaum in Germany - Aaron Swartz) On 1/7/14, Adam Back <adam(a)cypherspace.org> wrote: [deletia] >>took it to the next level including >> physical >> intrusion & hiding equipment. But MIT (and to a lesser extent JSTOR) let >> him down badly as did some of his academic friends and its tragic that he >> was a victim of some extremely over reaching imbalanced law the CFAA [3], >> aggressively prosecuted by self-agrandizing politically motivated, and >> almost legally immune deeply flawed US federal prosecution and plea bargain >> system, >yes but i think from my understanding it wasnt the amount of prison >time or the money but the fact that he wld have to plead guilty to 13 >felony counts - he would not get to serve in the government ... vote >etc From personal experience, I can shed light on the issue of voting as a felon. Contrary to what many people seem to think, most states seem to allow 'felons' to vote, eventually. (Some while they are in jail or prison; some immediately when they are released; some when they are off parole.) In my own case, the state of Washington's Constitution says that only felons guilty of "infamous crimes" lose their right to vote, and Washington state law defines an "infamous crime" as a crime punishable by one or more years incarceration in the _state_ penitentiary. Since my 'crime' was Federal, not state, it did not satisfy this condition, so I was not even prohibited from voting while I was in prison. (Though I never tried to vote while I was in prison; And, though, I did not learn that they didn't understand this fact until my release in late December 2009). I sent many emails to the Secretary of State of Washington stating this obvious position in early 2010, and they responded by repeatedly stating the contrary, commonly-thought position. They were never able to openly acknowledge I was right, although by my release from prison in March 2012, I checked their website and saw that they had corrected their prior, incorrect position. Jim "Al Capone" Bell

1 0

"Digital Cash", 3rd ed.
by Robert Hettinga 07 Jan '14

07 Jan '14

Peter Wayner surfaces with a third edition of "Digital Cash”: http://www.indiegogo.com/projects/digital-cash-3rd-edition Cheers, RAH Alla the old farts are crawlin’ outta the woodwork, um, aren’t we?

1 0

Re: Swartz, Weev & radical libertarian lexicon (Re: Jacob Appelbaum in Germany - Aaron Swartz)
by John Young 07 Jan '14

07 Jan '14

Anybody with a three-letter name of a website, or more grotesquely vain, a TLA nym, needs killing thrice as a bitter old diaper-wearing turd and tex-mexist marxian from Odessa, oil-capitalist murder capital of the USA.

3 2

NSA, FBI creep & rule of law, democracy itself (Re: [cryptography] To Protect and Infect Slides)
by Adam Back 07 Jan '14

07 Jan '14

This is indeed an interesting and scary question: On Sun, Jan 05, 2014 at 08:31:42PM +0300, ianG wrote: >What is a game changer is the relationship between the NSA and the >other USA civilian agencies. The breach of the civil/military line >is the one thing that has sent the fear level rocketing sky high, as >there is a widespread suspicion that the civil agencies cannot be >trusted to keep their fingers out of the pie. AKA systemic >corruption. If allied to national sigint capabilities, we're in a >world of pain. > >Question: Is there anything that can put some meat&metrics on how >developed and advanced this relationship is, how far the poison has >spread? How afraid should people in America be? maybe the most interesting and portenteous shift in power towards Orwellianism and totalitarianism in a century, as it affects the effectiveness of rule of law, and already weak separation of politics from law enforcement and justice system in the (current though slipping) super-power with unfortunate aspirations of extra-territorialism and international bullying. We're still a few decades from the cross over of financial dominance to Asia and BRICs, and most of those places are probably worse than the US by aspiration if thats possible, though less internet spying budget and capability. Unless something shapes up towards democracy in the super-power competitors we're in for a dismal century seemingly. That the NSA, and now seemingly FBI, see this I think maybe this FBI mission creep suggests the national security / law enforcement separation is slipping badly: http://news.slashdot.org/story/14/01/07/0015255/fbi-edits-mission-statement… | "Following the 9/11 attacks, the FBI picked up scores of new | responsibilities related to terrorism and counterintelligence while | maintaining a finite amount of resources. What's not in question is that | government agencies tend to benefit in numerous ways when considered | critical to national security as opposed to law enforcement. 'If you tie | yourself to national security, you get funding and you get exemptions on | disclosure cases,' said McClanahan. 'You get all the wonderful arguments | about how if you don't get your way, buildings will blow up and the | country will be less safe.'" so if even the FBI are getting their nose into the tent of unfetter access to historical data on everyone, plus informal channels and "tip-offs" on dirt on politically unpopular pepople - eg say effective security researchers like Applebaum, or effective journalists like Greenwald. (No "foreigners" dont feel very comforted, and the explict acknowledgment of tip-offs, and inforation channels to US domestic and international law enforcement, basically puts the entire planet at risk of politicaly motivated interference.) With retroactive search of your entire lifes electronic foot print including every "encrypted" IM, skype voip channel, contacts, emails, attorney client privileged and not, with no warrant or evidence presented to a judge for subpoena, the Orwell 2.0 system can probably fabricate or concoct trouble for 99% of the adult population of the planet. George Orwell 30 years late. We're pretty close to fucked as a civilization unless something pretty radical shifts in the political thinking and authorizations. And realistically it not even clear the NSA can politically be controlled anymore by the political system. Its very hard to influence something with that much skull-duggery built into its DNA, that many 10s of billions in outsourced defense contractor lobbying power, that much inertia and will to survive as an org, with military PSYOPs to turn on its own populace and political system, and black bag covert ops ties to dirty tricks in CIA, and judicial and law virtual immunity. They probably realistically went full speed ahead since the 11 Sep 2001, if not earlier on such things, and the scrapping. TIA wiki http://en.wikipedia.org/wiki/Total_Information_Awareness | Although the program was formally suspended [as of late 2003], its data | mining software was later adopted by other government agencies, with only | superficial changes being made. Probably even before since we nominally won the export regulation debacle and democractic countries were forced to admit it was inconsistent with their self-perception as open democratic countries, to be controlling and banning encryption software. The 21st century equivalent of book burning. Can we rectify this with the cypherpunks write code? Maybe as Schneier said in a discussion on this topic with Eben Moglen (at Moglen's respective university) maybe we can make it more expensive by deploying more crypto that is end to end secure, secure by default. ie more TOFU, more cert pinning, more certificate transparency distributed cert validation. Even the cert valiation maybe behind the game, perhaps NSA really do already have a lot of actual SSL private keys via hardware, software hacking and backdoors with manufacturer complicity or not, as well as just demanding them with NSL orders, gag orders as Lavabit showed finally with evidence. I wonder what proportion of SSL certs worldwide the five eyes/Orwell 2.0 shadow orwell 2.0 government have copies of? Adam

1 0