- cypherpunks - lists.cpunks.org

"a skilled backdoor-writer can defeat skilled auditors"?
by rysiek 05 Jun '14

05 Jun '14

Hi there, in a different thread, Cam posted a link containing this gem: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - In short several very skilled security auditors examined a small Python program — about 100 lines of code — into which three bugs had been inserted by the authors. There was an “easy,” “medium,” and “hard” backdoor. There were three or four teams of auditors. 1. One auditor found the “easy” and the “medium” ones in about 70 minutes, and then spent the rest of the day failing to find any other bugs. 2. One team of two auditors found the “easy” bug in about five hours, and spent the rest of the day failing to find any other bugs. 3. One auditor found the “easy” bug in about four hours, and then stopped. 4. One auditor either found no bugs or else was on a team with the third auditor — the report is unclear. See Chapter 7 of Yee’s report for these details. I should emphasize that that I personally consider these people to be extremely skilled. One possible conclusion that could be drawn from this experience is that a skilled backdoor-writer can defeat skilled auditors. This hypothesis holds that only accidental bugs can be reliably detected by auditors, not deliberately hidden bugs. Anyway, as far as I understand the bugs you folks left in were accidental bugs that you then deliberately didn’t-fix, rather than bugs that you intentionally made hard-to-spot. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://blog.spideroak.com/20140220090004-responsibly-bringing-new-cryptogr… I have no problem believing it is thus, but can't help wondering if there are any ways to mitigate it. -- Pozdr rysiek

7 13

[p2p-hackers] Reset The Net! And a LeastAuthority.com update
by Zooko Wilcox-OHearn 05 Jun '14

05 Jun '14

It is Reset The Net day! It is the one year anniversary of the Snowden disclosures. A coalition of many companies, organizations, and individuals is using this to urge people to adopt and deploy encryption software: https://ResetTheNet.org At LeastAuthority.com, we're announcing an upgrade to our verifiably end-to-end-encrypted cloud storage service: https://leastauthority.com/blog/ This service is all Free and Open Source software, based on the Tahoe-LAFS project: https://Tahoe-LAFS.org Regards, Zooko Wilcox-O'Hearn Founder, CEO, and Customer Support Rep https://LeastAuthority.com Freedom matters. _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers

1 0

stinky shit in fedland - lawful^H^H^Hless mobile fuckery cover-ups in progress...
by coderman 04 Jun '14

04 Jun '14

https://www.aclu.org/blog/national-security-technology-and-liberty/us-marsh… --- U.S. Marshals Seize Local Cops’ Cell Phone Tracking Files in Extraordinary Attempt to Keep Information From Public 06/03/2014 Government Secrecy By Nathan Freed Wessler, Staff Attorney, ACLU Speech, Privacy & Technology Project at 12:13pm A run-of-the-mill public records request about cell phone surveillance submitted to a local police department in Florida has unearthed blatant violations of open government laws, including an incredible seizure of state records by the U.S. Marshals Service, which is part of the Justice Department. Today the ACLU and the ACLU of Florida filed an emergency motion in state court to preserve the public’s right of access to government records. Over the past several months, the ACLU has filed dozens of public records requests with Florida law enforcement agencies seeking information about their use of controversial cell phone tracking devices known as “stingrays.” (The devices are also known as “cell site simulators” or “IMSI catchers.”) Stingrays track phones by mimicking service providers’ cell towers and sending out powerful signals that trick nearby phones — including phones of countless bystanders — into sending their locations and identifying information. The Florida agencies’ responses to our requests have varied widely, with some stonewalling and others releasing records. The most recent request went to the Sarasota Police Department, and the fallout from that request has raised red flag after red flag. RED FLAG #1: The Sarasota Police initially told us that they had responsive records, including applications filed by and orders issued to a local detective under the state “trap and trace” statute that he had relied on for authorization to conduct stingray surveillance. That raised the first red flag, since trap and trace orders are typically used to gather limited information about the phone numbers of incoming calls, not to track cell phones inside private spaces or conduct dragnet surveillance. And, such orders require a very low legal standard. As one federal magistrate judge has held, police should be permitted to use stingrays only after obtaining a probable cause warrant, if at all. RED FLAG #2: The Sarasota Police set up an appointment for us to inspect the applications and orders, as required by Florida law. But a few hours before that appointment, an assistant city attorney sent an email cancelling the meeting on the basis that the U.S. Marshals Service was claiming the records as their own and instructing the local cops not to release them. Their explanation: the Marshals Service had deputized the local officer, and therefore the records were actually the property of the federal government. We emphatically disagree, since the Sarasota detective created the applications, brought them to court, and retained the applications and orders in his files. Merely giving him a second title (“Special Deputy U.S. Marshal”) does not change these facts. But regardless, once the Sarasota Police Department received our records request, state law required them to hold onto the records for at least 30 days, to give us an opportunity to go to court and seek an order for release of the documents. Instead of complying with that clear legal obligation, the local police allowed the records to disappear by letting the U.S. Marshals drive down from their office in Tampa, seize the physical files, and move them to an unknown location. We’ve seen our fair share of federal government attempts to keep records about stingrays secret, but we’ve never seen an actual physical raid on state records in order to conceal them from public view. RED FLAG #3: Realizing we weren’t going to get hold of the Sarasota Police Department’s copies of the applications and orders anytime soon, we asked the county court if we could obtain copies from its files. Incredibly, the court said it had no copies. The court doesn’t even have docket entries indicating that applications were filed or orders issued. Apparently, the local detective came to court with a single paper copy of the application and proposed order, and then walked out with the same papers once signed by a judge. Court rules — and the First Amendment — require judges to retain copies of judicial records and to make them available to the public, but the court (and the detective) completely flouted those requirements here. The ACLU’s emergency motion seeks a temporary injunction preventing the Sarasota Police Department from transferring any more files to the U.S. Marshals, as well as a determination that the police violated state law by sending the stingray applications and orders to the Marshals Service in the first place and an order requiring the police to produce the records. When the government obtains court authorization to use invasive surveillance equipment, the public should not be kept in the dark. We have open records laws for a reason, but they mean nothing if the government can violate their clear commands at its whim.

1 3

#PayPal14: Distributed Donations of Support
by Douglas Lucas 04 Jun '14

04 Jun '14

Hi cypherpunks, I am one of the original authors of the May 12 press release http://pastebin.com/39nSLf94 "No Place to Hide: #PayPal14, Glenn Greenwald, and the PayPal Billionaire" Greenbacks' billionaire backer Pierre Omidyar makes the PayPal 14 pay $86,000 for Distributed Denial-of-Service attacks (DDOS), so we are promoting Distributed Donations-of-Support (DDOS): http://www.gofundme.com/Paypal14 Without need of celebrities or go-betweens, you can donate directly to the PayPal 14 at that page. If you can't chip in, please share that page and ask people to go back to their roots by helping political prisoners/hostages directly. The first week the op raised $5,052. The second week the op raised $2,298. Tonight alone the op raised $180. We had no SONY movie deal and didn't redact anything. I am sure people who have difficulty unhitching their wagons from celebrities and 'Thought Leaders' will say what a bad idea it is to attack Redaction White Man who is telling multi-millionaire anchors about the NSA to an audience who has already gotten the message the NSA spies on every undefended gizmo. By the way, the US is not the world; did you know Nigeria has 'NSA capability' from Israeli tech? The op got two cool articles the first week: http://www.ibtimes.co.uk/anonymous-paypal14-campaign-spreads-pirated-copy-g… http://rt.com/usa/158976-greenwald-anonymous-paypal-pastebin/ And best of all, got brave people protesting Greenbacks' Boston tour stop in person (pics!): https://twitter.com/Lyzard/status/467085082734624768 https://twitter.com/Aan_ath/status/467101897627668480 https://twitter.com/Free_Hammond/status/467111734579568641 https://twitter.com/Aan_ath/status/467154122995924992 Op-ed expected later this week. Thanks, Douglas

1 0

Huge Snowden Leak
by jim bell 04 Jun '14

04 Jun '14

http://finance.yahoo.com/news/theres-huge-snowden-leak-no-183610597.html On Tuesday, news site The Register published a story containing explosive "above top secret" information about Britain's surveillance programs, including details of a "clandestine British base tapping undersea cables in the Middle East." Reporter Duncan Campbell, who wrote the story, said it was based on documents "leaked by fugitive NSA sysadmin Edward Snowden" that other news outlets had declined to publish. However, it's not necessarily clear how Campbell got his hands on Snowden's document stash. Glenn Greenwald, who published the first stories based on Snowden's documents in The Guardian, told Business Insider on Tuesday that Snowden has "no source relationship" with Campbell. "Snowden has no source relationship with Duncan (who is a great journalist), and never provided documents to him directly or indirectly, as Snowden has made clear," Greenwald said in an email. "I can engage in informed speculation about how Duncan got this document — it's certainly a document that several people in the Guardian UK possessed — but how he got it is something only he can answer." For his part, Campbell is not interested in discussing how he got the documents used for his story. "Journalists in the UK — just as in the US — do not reveal their sources, or respond to questions as to confidential sources. We protect them. That is our obligation and our duty," Campbell wrote in an email to Business Insider. This isn't the first story Campbell has published allegedly based on Snowden documents. Last August, Campbell wrote a piece for The Independent about the secret British surveillance base. In that article, Campbell suggested The Guardian "agreed to the Government’s request not to publish any material contained in the Snowden documents that could damage national security," including the existence of the surveillance base. Greenwald responded with a column that included a statement from Snowden saying he had not worked with Campbell and speculating the documents were actually by the British government as part of an attempt to make the case his leaks were "harmful." In addition to Snowden's theory that Campbell may have obtained documents from a government source, it also seems possible he was leaked information by a Guardian staffer with access to the documents. Business Insider asked Guardian editor Alan Rusbridger about this possibility on Tuesday and received a response from a representative for the paper who said they have no idea how Campbell obtained any of Snowden's documents. "We don't know who Mr Campbell's source is. We have always been open and transparent about all of our reporting partners," the representative said. So it seems someone out there is in possession of Snowden documents other newspapers have declined to publish and is eager to release them. In other words, the Snowden leaks have leaked. [UPDATE 20:45 EDT] Duncan Campbell told Wired UK that he " was able to look at some of the material provided in Britain to the Guardian by Edward Snowden last year." Campbell, who has been reporting about Britain's signals intelligence agency (GCHQ) for more than 30 years, would not answer a question about whether he has copies of the relevant documents.

1 0

PBS Frontline and "The Program"'s "innovative" legal interpretations [was: stinky shit in fedland - lawful^H^H^Hless mobile fuckery cover-ups in progress...]
by coderman 04 Jun '14

04 Jun '14

regarding the parallel construction and warantless / indiscriminate techniques, the PBS Frontline program "United States of Secrets" provides an exceptional analysis of how these invasive and un-constitutional programs and arguments came into being and expanded across administrations. http://www.pbs.org/wgbh/pages/frontline/united-states-of-secrets/ or http://www.pbs.org/wgbh/pages/frontline/government-elections-politics/unite… # convenient links, for those who can't torrent / stream https://peertech.org/files/PBS.Frontline.2014.United.States.of.Secrets.1.mp4 https://peertech.org/files/PBS.Frontline.2014.United.States.of.Secrets.2.mp4 # plaintext for those with poor clients who can't speak strong SSL/TLS http://207.198.103.187:8081/PBS.Frontline.2014.United.States.of.Secrets.1.m… http://207.198.103.187:8081/PBS.Frontline.2014.United.States.of.Secrets.2.m… best regards, On Tue, Jun 3, 2014 at 8:12 PM, coderman <coderman(a)gmail.com> wrote: > ... > - Truly In-discriminant and Whole-sale Invasions of Constitutionally > Protected Communications Are Routine Fed Behaviors > and not just routine but the expected side effects of military > blunt-force intelligence gathering systems aimed at domestic targets > illegally. these military systems covertly re-purposed for domestic > surveillance at the federal level enjoy FBI DITU running front-man and > cover for all the exceptional secrecy this programs entails. (and why > such truly aggressive offensive techniques applied indiscriminately > have yet to reach state and municipal LE need to know.)

1 0

Fwd: Announcement of Commencement of Bankruptcy Proceedings
by Travis Biehn 04 Jun '14

04 Jun '14

Kobayashi ---------- Forwarded message ---------- From: "MtGox Bankruptcy Trustee" <mtgox_trustee(a)noandt.com> Date: May 30, 2014 2:16 AM Subject: Announcement of Commencement of Bankruptcy Proceedings To: "MtGox Bankruptcy Trustee" <mtgox_trustee(a)noandt.com> Cc: 関係人各位株式会社MTGOX（以下「MTGOX」といいます。）につき、平成26年4月24日午後5時00分、東京地方裁判所より破産手続開始決定がなされ、当職が破産管財人に選任されました（東京地方裁判所平成26年（フ）第3830号）。今後、破産管財人において、MTGOXの財産管理換価、債権調査等の破産手続を遂行していきます。つきましては、関係者に対する情報提供を目的として、破産手続に関する基本的事項を添付のとおりお知らせいたしますので、ご確認ください。なお、このメールアドレス（mtgox_trustee(a)noandt.com ）は破産管財人からの送信専用であり、貴殿が本メールアドレス宛の返信等をされても内容確認及び回答などの対応はできません。破産手続の進行等については、ウェブサイト（ http://www.mtgox.com/ ）で情報提供をする予定ですので、当該ウェブサイトをご確認ください。宜しくお願いいたします。破産者株式会社MTGOX 破産管財人弁護士小林信明 To whom it may concern, At 5:00 p.m. on April 24, 2014, the Tokyo District Court granted the order for the commencement of the bankruptcy proceedings vis-à-vis MtGox Co., Ltd. (“MtGox”), and based upon such order, I was appointed as the bankruptcy trustee (Tokyo District Court 2014 (fu) no. 3830). The bankruptcy trustee will implement the bankruptcy proceedings, including the administration and realization of the assets and investigation of the claims. For the purpose of providing information to the related parties, we hereby inform you of the basic matters regarding the bankruptcy proceedings as attached. This email address（mtgox_trustee(a)noandt.com) is used only for the purpose of sending messages, and we are unable to check and respond to any replies to this email address. Since we plan to provide the information regarding the bankruptcy proceedings by posting it on the website hosted by the bankruptcy trustee ( http://www.mtgox.com/ ), please check this website. Bankrupt MtGox Co., Ltd. Bankruptcy trustee Attorney-at-law Nobuaki Kobayashi

2 1

Re: Pirate Bay co-founder Peter Sunde arrested
by jim bell 04 Jun '14

04 Jun '14

Perhaps Tsarnaev is officially being charged by Massachusetts too, and thus (for now, at least) is in Massachusetts custody. Jim Bell (been there, done that) ________________________________ From: Douglas Lucas <dal(a)riseup.net> To: cypherpunks(a)cpunks.org; carimachet(a)gmail.com Sent: Tuesday, June 3, 2014 1:54 PM Subject: Re: Fw: Pirate Bay co-founder Peter Sunde arrested I am told--maybe incorrectly--that alleged Boston Bomber (but see WhoWhatWhy's reporting) Dzhokhar Tsarnaev should be in the Federal Prison inmate locator, but isn't. So maybe the people behind the locator are sometimes deceptive. Douglas On 06/03/2014 02:23 AM, jim bell wrote: > I just realized that he probably isn't yet returned (extradited) to the > US, and thus probably won't be listed in the BOP Inmate locator system. > > ----- Forwarded Message ----- > *From:* jim bell <jamesdbell9(a)yahoo.com> > *To:* Cari Machet <carimachet(a)gmail.com> > *Sent:* Monday, June 2, 2014 8:37 PM > *Subject:* Re: Pirate Bay co-founder Peter Sunde arrested > > There is such a thing as a Federal Prison inmate locator. > http://www.bop.gov/inmateloc/ > I tried it, but it doesn't show him. ( I don't know his age, etc.) It > would certainly show him if he is convicted, but before? Let's figure > out where (which city) he is in. Sometimes Federal prisoners are sent > to county jails while they are waiting for a trial. > Jim Bell > > > > ------------------------------------------------------------------------ > *From:* Cari Machet <carimachet(a)gmail.com> > *To:* jim bell <jamesdbell9(a)yahoo.com> > *Cc:* "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> > *Sent:* Monday, June 2, 2014 12:48 PM > *Subject:* Re: Pirate Bay co-founder Peter Sunde arrested > > hey any info on where mail can be sent wld be helpful - thanks > > > On Sun, Jun 1, 2014 at 7:13 PM, jim bell <jamesdbell9(a)yahoo.com > <mailto:jamesdbell9@yahoo.com>> wrote: > > http://news.yahoo.com/law-finally-catches-pirate-bay-torrent-co-founder-144… > > Pirate Bay co-founder Peter Sunde was arrested late Saturday after > being on the lam for nearly two years. One of the minds behind the > popular-yet-tantalizingly-illegal file-sharing service had been set > to serve jail time for copyright violations when he bolted. > > > >

2 1

Fw: Pirate Bay co-founder Peter Sunde arrested
by jim bell 03 Jun '14

03 Jun '14

I just realized that he probably isn't yet returned (extradited) to the US, and thus probably won't be listed in the BOP Inmate locator system. ----- Forwarded Message ----- From: jim bell <jamesdbell9(a)yahoo.com> To: Cari Machet <carimachet(a)gmail.com> Sent: Monday, June 2, 2014 8:37 PM Subject: Re: Pirate Bay co-founder Peter Sunde arrested There is such a thing as a Federal Prison inmate locator. http://www.bop.gov/inmateloc/ I tried it, but it doesn't show him. ( I don't know his age, etc.) It would certainly show him if he is convicted, but before? Let's figure out where (which city) he is in. Sometimes Federal prisoners are sent to county jails while they are waiting for a trial. Jim Bell ________________________________ From: Cari Machet <carimachet(a)gmail.com> To: jim bell <jamesdbell9(a)yahoo.com> Cc: "cypherpunks(a)cpunks.org" <cypherpunks(a)cpunks.org> Sent: Monday, June 2, 2014 12:48 PM Subject: Re: Pirate Bay co-founder Peter Sunde arrested hey any info on where mail can be sent wld be helpful - thanks On Sun, Jun 1, 2014 at 7:13 PM, jim bell <jamesdbell9(a)yahoo.com> wrote: http://news.yahoo.com/law-finally-catches-pirate-bay-torrent-co-founder-144… > > > >Pirate Bay co-founder Peter Sunde was arrested late Saturday after being on the lam for nearly two years. One of the minds behind the popular-yet-tantalizingly-illegal file-sharing service had been set to serve jail time for copyright violations when he bolted. >

2 1

TrueCrypt continuation
by Александр 03 Jun '14

03 Jun '14

*http://truecrypt.ch/ <http://truecrypt.ch/>http://geekcrypt.net/ <http://geekcrypt.net/>*

1 0