- cypherpunks - lists.cpunks.org

Tinfoil Chat
by oottela 09 Jun '14

09 Jun '14

I'd like to share a project I came up with back in spring 2012 and begun working after the Snowden leaks started. Highlights are -OTP encryption for perfect secrecy -OTP encrypted Keccak HMACs to prevent undetectable message tampering -HW TRNG to generate truly random keys (Von Neumann whitened) -HW Data diodes to provide immunity against message exfiltration attacks originating from network. Source code and links to whitepaper and manual are available from https://github.com/maqp/tfc/ Regards, Markus

2 1

Going to jail nowadays for owning a book, wtf?
by Georgi Guninski 08 Jun '14

08 Jun '14

AFAICT someone might go to jail for owning a book (not sure if paper or electronic): >From wikipedia (old revision): https://en.wikipedia.org/w/index.php?title=Abu_Hamza_al-Masri&oldid=6095135… --- Guilty of one charge of "possessing a document containing information likely to be useful to a person committing or preparing an act of terrorism"[31] under the Terrorism Act 2000, s58. This charge under the Terrorism Act of 2000 related to his possession of an Encyclopedia of Afghan Jihad, an Al Qaeda Handbook and other propaganda materials produced by Abu Hamza.[32] ---

5 10

New vulnerability in OpenSSL
by jim bell 08 Jun '14

08 Jun '14

https://www.yahoo.com/tech/here-we-go-again-new-vulnerability-discovered-in… BOSTON — Security researchers have uncovered new bugs in the Web encryption software that caused the pernicious “Heartbleed” Internet threat that surfaced in April. Experts said the newly discovered vulnerabilities in OpenSSL, which could allow hackers to spy on communications, do not appear to be as serious a threat as Heartbleed. The new bugs were disclosed on Thursday as the group responsible for developing that software released an OpenSSL update that contains seven security fixes. Experts said that websites and technology firms that use OpenSSL technology should install the update on their systems as quickly as possible. Still, they said that could take several days or weeks because companies need to first test systems to make sure they are compatible with the update. "They are going to have to patch. This will take some time," said Lee Weiner, senior vice president with cybersecurity software maker Rapid7. OpenSSL technology is used on about two-thirds of all websites, including ones run by Amazon.com, Facebook, Google, and Yahoo. It is also incorporated into thousands of technology products from companies, including Cisco Systems, Hewlett-Packard, IBM, Intel, and Oracle. The widespread Heartbleed bug surfaced in April when it was disclosed that the flaw potentially exposed users of those websites and technologies to attack by hackers who could steal large quantities of data without leaving a trace. That prompted fear that attackers may have compromised large numbers of networks without their knowledge. Security experts said Thursday that the newly discovered bugs are more difficult to exploit than Heartbleed, making those vulnerabilities less of a threat. Still, until users of the technology update their systems, “there is a window of opportunity” for sophisticated hackers to launch attacks and exploit the newly uncovered vulnerabilities, said Tal Klein, vice president of strategy with cloud security firm Adallom.

3 2

US Army research into quantum teleportation of data
by Gregory Foster 08 Jun '14

08 Jun '14

Defense Systems (May 30) - "Teleporting information sets stage for ‘cyber secure’ communications": http://defensesystems.com/Articles/2014/05/30/ARL-Teleportation.aspx Lots of challenges to overcome, but the advantages are sufficiently self-evident and seductive to likely warrant substantial funding. A use case not mentioned: remotely piloted aircraft (drones) without network lag. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

2 1

Re: [Cryptography] Help investigate cell phone snooping by police nationwide
by grarpamp 08 Jun '14

08 Jun '14

On Sat, Jun 7, 2014 at 11:45 PM, Sidney Markowitz <sidney(a)sidney.com> wrote: > I don't know what would make me feel safer - putting the phones in a microwave > oven with the chance that the door could easily be left ajar, or getting the > acoustic insulation and masking hum of a refrigerator. Trust the microwave you tested, right, because you do not know what quality DSP is pricessing your remaining 5dB audio over your entire conversation. Or put microwave in fridge ;) aka: remove battery / crush/displace phone... be happy.

1 0

[was: Internet Giants erect barriers to spy agencies]
by coderman 07 Jun '14

07 Jun '14

On Fri, Jun 6, 2014 at 10:50 PM, jim bell <jamesdbell9(a)yahoo.com> wrote: > ... > After years of cooperating with the government, the immediate goal now is to > thwart Washington — as well as Beijing and Moscow. i'm holding my breath...

1 0

Fwd: Help investigate cell phone snooping by police nationwide
by coderman 07 Jun '14

07 Jun '14

---------- Forwarded message ---------- From: Michael at MuckRock <michael(a)muckrock.com> Date: Fri, Jun 6, 2014 at 7:53 AM Subject: Help investigate cell phone snooping by police nationwide Hi, Right now, we're gearing for MuckRock's biggest investigative project yet, and we need your help. First, a little context. Local police departments across America are increasingly tapping into information from your cell phone: Your location, who you're with, who you are calling. Using fake cell phone towers, often called Stingrays, they generally don't even need a warrant, and have relatively few restrictions on who, when, and what they collect. Or how they use it. Since these programs are often funded by federal grants, very few people outside of law enforcement know how, or even if, they're being used, with almost non-existent debate about if this information should be collected, and what limits should be set for for how it's used or how long it's kept. This is where you come in. We're launching this project on Beacon Reader, where a donation of just $5, about what it costs for us to successfully file a request, can make a big difference. Just like with the Drone Census, often times MuckRock is the *only* group asking for this information, which otherwise would never be made public. You can support the project at this link, and, again, even just $5 can make a huge difference: https://www.muckrock.com/ If you're not in a position to help financially, we would still really appreciate your help — share what we're up to with your friends, sending in news articles you see or tips regarding cell phone tracking, and, in a few days, sending in information regarding which departments you'd like us to file with through a special page on MuckRock. Thanks for all your support in the past, and we're looking forward to working with you to shine a light on this under-reported area. Thanks, Michael

3 5

Re: [cryptome] Re: Fwd: Help investigate cell phone snooping by police nationwide
by coderman 07 Jun '14

07 Jun '14

On Fri, Jun 6, 2014 at 8:42 PM, <shelley(a)misanthropia.info> wrote: >.... > Unfortunately, using airplane mode is not enough to keep you from being > tracked. You must remove the battery. i can confirm this directly. a ride into Vegas for DC 20 demonstrated that Alexander's toys have the ability to inject into receive only (airplane mode) and tip to exploitation. (baseband exploits being exceptional at leaking keys, elevating privs, and erasing tracks...) battery out or faraday caged the only effective options. (or as Snowden demonstrated, put in a fridge to avoid scrutiny and audio capture the best idea. non-serial tower associations are an anomaly alerted and acted upon.)

1 0

Reset the Net
by Jerry 06 Jun '14

06 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Anyone else find it ironic that the reset the net site asks you to take back your privacy online by providing your email address? "On June 5, I will take strong steps to protect my freedom from government mass surveillance. I expect the services I use to do the same." https://www.resetthenet.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJTkHskAAoJEBuh/pdhlD5190QH/07t6NrJjKWlJr1LMQFFmx1S l6mDhq1DYO97lio2AYslNv4bL98cIK/uWpI/Z3AsnJfvhzC9rl5MhiYkmeNbSt4U cPmPA9OWJtWPEU1d1978rAWfz3+OnbLgnm9FYGJyJpcnokedomldJnerj2pVp9/+ OmEd9JsirDug0sW6Uf0m8gMPTLvrbC9QmGdM7QJw8Ela1+iN9HJbCn3iiW2aH5v5 QNw4zFbpdTkRG6enkVSkUk5Z3J9lmIO6w9m1rmeQ3MABhyzOOsbqqNmr04plD0QW Qnisa9XbeWgxz+v1puV0+n2oWBJk78M70a8s9b+jrhXHiAtPV5uzyddrqo3sV60= =zPS+ -----END PGP SIGNATURE-----

4 3

Cellphone Operator Reveals Scale of Government Snooping
by jim bell 06 Jun '14

06 Jun '14

http://news.yahoo.com/cellphone-operator-reveals-scale-govt-snooping-114153… LONDON (AP) — Government snooping into phone networks is extensive worldwide, one of the world's largest cellphone companies revealed Friday, saying that several countries demand direct access to its networks without warrant or prior notice. The most explosive revelation was that in six countries, authorities require immediate access to an operator's network — bypassing legal niceties like warrants. It did not name the countries for legal reasons and to safeguard employees working there.The detailed report from Vodafone, which covers the 29 countries in which it operates in Europe, Africa and Asia, provides the most comprehensive look to date at how governments monitor mobile phone communications. It amounts to a call for a debate on the issue as businesses increasingly worry about being seen as worthy of trust. "In those countries, Vodafone will not receive any form of demand for lawful interception access as the relevant agencies and authorities already have permanent access to customer communications via their own direct link," the report said. Vodafone's report comes one year after former NSA systems analyst Edward Snowden revealed that U.S. and other countries' intelligence agencies routinely gathered huge amounts of private data belonging to millions of innocent people in America and across the globe. The revelations have focused particular attention on the role of Western technology and telecommunications firms, which stand accused of facilitating the mass surveillance by giving spies unrestricted access to their networks. Several Silicon Valley companies have since attempted to restore consumers' trust by publishing data on government surveillance. By making its report public, together with a breakdown on requests for information, Vodafone took the unusual step of entering the international debate about balancing the rights of privacy against security. Rather than being stuck with responsibility and consumer backlash when consumers realize their data has been scooped up without their knowledge, companies like Vodafone have decided it is time to push for a debate.But telecoms companies found themselves in an even more uncomfortable position. Historically closer to governments since many were once state-owned, telecoms companies are much more heavily regulated and have employees on the ground — making them more sensitive to government demands for data. "Companies are recognizing they have a responsibility to disclose government access," Daniel Castro, senior analyst for the Information Technology and Innovation Foundation in Washington, D.C. "This is new." The study comes at a time when other businesses are also calling for a revamp of laws too outdated to stand up to the quickly changing telecommunications universe. Executives in Silicon Valley, for example, have stepped up pressure on President Barack Obama to curb the U.S. government surveillance programs that collect information off the Internet. "They want their customers to be able to trust them to store their data in a private and secure manner," Castro said.Twitter Inc., LinkedIn Corp., AOL Inc., Google Inc., Apple Inc., Yahoo Inc., Facebook Inc. and Microsoft Corp. are pushing for tighter controls over electronic espionage — fearing that eavesdropping threatens the technology industry's financial livelihood. Vodafone's report is also seen by some as an effort to turn the page on the company's embarrassing role in the protests that toppled Egyptian strongman Hosni Mubarak in 2011. As the protests raged, Vodafone bombarded its Egyptian subscribers with pro-government text messages. At the time, the company said it had no choice but to comply, but was severely criticized for its actions. A change in culture followed. "They took a hard lesson there," said Cynthia Wong, a senior internet researcher at Human Rights Watch. "Even if the government is the ultimate problem, they realized they needed to take steps to mitigate harm to their users." Civil rights advocates applauded Vodafone for releasing the report, and cracking open the debate, even as they expressed alarm at the infringements into civil rights. "For governments to access phone calls at the flick of a switch is unprecedented and terrifying," said Shami Chakrabarti, director of the human rights group Liberty, adding that the Snowden revelations showed the Internet was already being treated as "fair game." "Bluster that all is well is wearing pretty thin - our analogue laws need a digital overhaul," she said. Though some of the governments included in the report were able to block disclosure of any aspect of how interception was conducted, the report is unique in that it offers insight into how governments conduct surveillance. Though some of the U.S. operators, such as AT&T and Verizon offered information amid the Snowden allegations, the level of detail is minuscule compared with Friday's report, Wong said. Civil rights advocates weren't the only ones applauding Vodafone's actions. Norway's Telenor Group, which also has operations across Eastern Europe and Asia, offered support, noting governments have the ultimate responsibility to act. The countries included in the report are: Albania, Australia, Belgium, the Czech Republic, Congo, Egypt, Fiji, France, Germany, Ghana, Greece, Hungary, India, Ireland, Italy, Kenya, Lesotho, Malta, Mozambique, the Netherlands, New Zealand, Portugal, Qatar, Romania, South Africa, Spain, Tanzania, Turkey and the U.K. Associated Press Writers Raphael Satter in London, Jan M. Olsen in Copenhagen contributed to this report.

2 1