- cypherpunks - lists.cpunks.org

Truecrypt tinfoil hat testing
by NullDev 30 May '14

30 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 With exquisite timing, I bought a new external HDD yesterday (28.05.14) and set about encrypting it with TrueCrypt. I installed via the terminal as I'm on Linux, ie: wget http://www.truecrypt.org/download/truecrypt-7.1a-linux-x64.tar.gz I extracted it, and encrypted my drive. The TrueCrypt website was looking it's normal self at that point: I referred to it a few times during the encryption. However, no sooner had it finished at about 4pm UK time yesterday, I received the first email from someone on the list about Truecrypt pulling the plug. Their site had been changed to the one we see today, recommending we switch to an alternative like, ahem, something as fabulously secure as Bitlocker. Ironic timing, huh? So, I have what was possibly the last download of a version 7.1a tarball before everything went titsup, and if you read what The Register said about Truecrypt's V.7.2 being corrupted/infected/backdoored here: http://www.theregister.co.uk/2014/05/28/truecrypt_hack/ Then theoretically I have something to wonder about. However, it would appear that the date, checksum and verification are ok on what I downloaded. It *seems* clean. It would be interesting to see if it's in anyone's scope to compare the source code with other versions of 7.1a for Linux: it's beyond mine, apologies. If anyone wants me to send them the tarball I'll be happy to oblige. Let me know if I can be of assistance. Best, NullDev -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTh5c/AAoJELavgB137JPDHEsIAI2Dt4qVnWZb4FUxUOZBN4cs WfXXofFRodZ0e1yK/IxmrwShp/d9eNJdBx/aGuERoAQ1jlLjRNsyfmzpF7zJMYsb PD/uS2ZiXXP8UjbWNAEBOhrBV1dPGSj86twpsVXMFuBrzbKZHMmWKHxp9cNpwMLQ WbPIqVaDGVb4V5d/yyFPk9/uELReIQKobML6hzGgxlWRc5XH/9403YcSc0iMe0bp oSpOd69hRddvLssX76TUxbyS1k+hc2+zXxsaxqd8lS3J7F6YRzZHTRD/BEqTva8Y OseOVwYGBX+kEUeXEh13yzsHao9RR6DFEhZL7yVAJb88GQvMgT6f+4IO6TJcJ8A= =P4+W -----END PGP SIGNATURE-----

5 6

NSL's [was TrueCrypt]
by grarpamp 30 May '14

30 May '14

> Have NSLs held up in court against the First Amendment? > It's already constitutional that freedom of speech cannot be prevented > except to prevent immediate, tangible harm to others. > If you want > to challenge them, publish one on your blog and say "sue me, let's see what > the supreme court says". This above is exactly one of the key issues. Either - You have the right to speak freely under the 1st, or you don't. - NSL's are 4th compliant warrants, or common orders/subpoenas, having all been reviewed and issued by a judge having jurisdiction, subject to challenge, etc... or they aren't. - The FISA court is a proper court established, operating and regulated under the judicial branch, beholden to the Supreme, or it isn't. Some say: You do, they're toilet paper, it's legislative or executive. With thousands of letters issued there are similarly many chances to challenge it, yet so far it seems only a few have started on the direct route and everyone else seems too chicken. That ratio could really be improved. [For the schemers, and though not really a proper stand up fight, there are probably even a few dual citizens who have received them who could just as happily relocate back home offshore and publish (if not fight) from there. You at least retain the first person perspective that way.] https://en.wikipedia.org/wiki/National_Security_Letter http://www.law.cornell.edu/wex/first_amendment http://www.law.cornell.edu/wex/fourth_amendment https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillan… https://en.wikipedia.org/wiki/Patriot_Act

2 1

Re: [cryptome] Hector Sabu Monseur Sentencing Transcript
by shelley＠misanthropia.info 29 May '14

29 May '14

On Tue, May 27, 2014, at 11:59 AM, John Young wrote: > Held today, 11AM. So one script-kiddie, pig-kissing snitch managed to help thwart "hundreds" of "cyber attacks" (translation: /b/tard summer crew, stupid enough to still use LOIC), while the NSA's whole Stasi-on-steroids spying infrastructure couldn't find one needle in that haystack of all our calls and emails? Well, isn't that special...

4 4

Re: is truecrypt dead?
by shelley＠misanthropia.info 29 May '14

29 May '14

Krebs has put a post about it: http://krebsonsecurity.com/2014/05/true-goodbye-using-truecrypt-is-not-secu… excerpt: "Doubters soon questioned whether the redirect was a hoax or the result of the TrueCrypt site being hacked. But a cursory review of the site’s historic hosting, WHOIS and DNS records shows no substantive changes recently. What’s more, the last version of TrueCrypt uploaded to the site on May 27 (still available at this link) shows that the key used to sign the executable installer file is the same one that was used to sign the program back in January 2014 (hat tip to @runasand and @pyllyukko). Taken together, these two facts suggest that the message is legitimate, and that TrueCrypt is officially being retired. That was the same conclusion reached by Matthew Green, a cryptographer and research professor at the Johns Hopkins University Information Security Institute and a longtime skeptic of TrueCrypt — which has been developed for the past 10 years by a team of anonymous coders who appear to have worked diligently to keep their identities hidden. “I think the TrueCrypt team did this,” Green said in a phone interview. “They decided to quit and this is their signature way of doing it.”

1 0

Harvard and MIT Students Launch ‘NSA-Proof’ Email Service | Betabeat
by J.R. Jones 27 May '14

27 May '14

Have you guys seen this? What say ye? http://betabeat.com/2014/05/harvard-and-mit-students-launch-nsa-proof-email…

11 18

House Passes Curbs on NSA Phone Surveillance
by jim bell 24 May '14

24 May '14

http://news.yahoo.com/house-passes-curbs-nsa-phone-surveillance-221025685--… WASHINGTON (AP) — In an overwhelming vote, the House moved the U.S. closer to ending the National Security Agency's bulk collection of Americans' phone records Thursday, the most significant demonstration to date of leaker Edward Snowden's impact on the debate over privacy versus security. But the final version of the legislation, "watered down" in the words of one supporter, also showed the limits of that impact. The bill was severely weakened to mollify U.S. intelligence agencies, which insisted that the surveillance programs that shocked many Americans are a critical bulwark against terror plots. The bill was approved 303-121, which means that most House members can now say they voted to end what many critics consider the most troubling practice Snowden disclosed — the collection and storage of U.S. calling data by the secretive intelligence agency. But almost no other major provision designed to restrict NSA surveillance, including limits on the secret court that grants warrants to search the data, survived the negotiations to get the bill to the House floor. And even the prohibition on bulk collection of Americans' communications records has been called into question by some activists who say a last-minute change in wording diminished what was sold as a ban. "People will say, 'We did something, and isn't something enough,'" said Steven Aftergood, who tracks intelligence issues for the Federation of American Scientists. "But this bill doesn't fundamentally resolve the uncertainties that generated the whole controversy." Though some privacy activists continued to back the bill, others withdrew support, as did technology companies such as Google and Facebook. View gallery Rep. Mike Rogers of Michigan, the Republican chairman of the House Intelligence Committee, said, "I believe this is a workable compromise that protects the core function of a counterterrorism program we know has saved lives around the world." The measure now heads to the Senate, where Majority Leader Harry Reid, D-Nev., told reporters Thursday that "we must do something." The USA Freedom Act would codify a proposal made in January by President Barack Obama, who said he wanted to end the NSA's practice of collecting and storing the "to and from" records of nearly every American landline telephone call under a program that searched the data for connections to terrorist plots abroad. The phone records program was revealed though the leaks last year by Snowden, who used his job as a computer network administrator to remove tens of thousands of secret documents from an NSA facility in Hawaii. Snowden fled first to China, then Russia where he is avoiding an extradition order to face criminal charges for revealing classified information. The phone companies create and store those billing records, and the legislation still would give the NSA authority to request batches of data from the companies to search in terrorism investigations in response to a judicial order. Law enforcement agents routinely obtain such records in criminal investigations. HOUSE VOTES TO CURB NSA DATA COLLECTION The USA Freedom Act started its life as the idea of those who wanted to clamp down on NSA surveillance, but it was "watered down," as Rep. Jan Schakowsky, D-Ill., acknowledged, shedding a series of provisions favored by civil liberties activists. Some activists continued to back the bill, including the American Civil Liberties Union, whose Washington legislative director, Laura Murphy, called it an imperfect but "unambiguous statement of congressional intent to rein in the out-of-control NSA." Technology companies such as Google and Facebook said they were most concerned with a last-minute definition change that they fear will allow the government to collect huge volumes of records — including, for example, records of all the phone calls made from a particular U.S. city during a certain period, or all the internet data associated with a particular commercial router. The bill's original text limited the government's data requests to those associated with specific people, entities or accounts. The approved version says the government may use any "specific selection term" to set the parameters of its search, including a type of device or an address. The new language appears to allow much broader data requests. "The new version deliberately contains ambiguity in a very critical area," said Harley Geiger, senior counsel for the Center for Democracy and Technology. "We've learned about the government track record of exploiting ambiguity in the law to broaden its surveillance activity." Rep. Adam Schiff, D-Calif., a member of the House Intelligence Committee, said the vagueness was designed to protect the government's surveillance methods, not to facilitate secret bulk collection. Other provisions that were dropped from the bill included requirements to estimate the number of Americans whose records were captured under the program, and the creation of a public advocate to challenge the government's legal arguments before the secret surveillance court. NSA officials were pleased with the bill for another reason: The new arrangement will give them access to mobile calling records they did not have under the old program.

5 4

the Great Filter of private communication
by coderman 24 May '14

24 May '14

we have the maths! we have the technology! ... yet actual robust, private communications remain elusive. where the "Great Filter" thwarting our privacy codes? is it usability; anything more than invisibly automatic a failure? is it cost; anything more than zero too much to bear in the market? is it correctness; anything less than a single mode always secure, broken? perhaps all of these above, each a requisite element of robustness, further compounding the difficulty of realizing an ideal.

5 11

Re: [liberationtech] PBS Frontline: United States of Secrets ( 2 part series )
by Gregory Foster 24 May '14

24 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Had intended to xpost. gf - -------- Original Message -------- Subject: Re: [liberationtech] PBS Frontline: United States of Secrets ( 2 part series ) Date: Fri, 23 May 2014 23:04:43 -0500 From: Gregory Foster To: liberationtech <liberationtech(a)lists.stanford.edu> CC: warrants-for-surveillance-tx(a)googlegroups.com, effaustin-discuss(a)lists.effaustin.org, rt4atx-list(a)cryptoglass.us On Wednesday, May 14, 2014 7:07 PM, Nicholas Merrill wrote: > United States of Secrets (Part One) > > "How did the government come to spy on millions of Americans? In > United States of Secrets, FRONTLINE goes behind the headlines to > reveal the dramatic inside story of the U.S. government's massive > and controversial secret surveillance program -- and the lengths > it went to try to keep it hidden from the public." > > http://www.pbs.org/wgbh/pages/frontline/united-states-of-secrets/ > http://video.pbs.org/video/2365245528/ > > Part 2 airs May 20th > > -Nick > > Nicholas Merrill, Executive Director, The Calyx Institute On Wednesday, May 14, 2014 7:15 PM PDT, James S. Tyre wrote: > Requires Flash, but pretty good even for those of us who've been > involved directly for A Very Long Time, likely much better for > those not intimately familiar. > > James S. Tyre, Law Offices of James S. Tyre Special Counsel, > Electronic Frontier Foundation https://www.eff.org Part 2 was broadcast on May 20th and is available at the FRONTLINE website linked above. Also available at ThoughtMaybe: http://thoughtmaybe.com/the-united-states-of-secrets/ Well weaves together The Story of The Program, and its unraveling. Of great importance, please take a look. gf - -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTgDXCAAoJEMaAACmjGtgjzuEQAI/btKhtWLzJA6enMa37K0WB /5BsLgHTQfhCljemIEsi+Ifr7HMtfVrSC2TTjr1teGhZ3l1AF3jQIP9yxepB9dMo 3ykbQagJnVEYwd1hwYV9UxKb5VruoY2nI7L8vTIFlM6pagNnqSB/7KmlfWaIkTXF jD3rYuXlchSPJXLm+Rd/Q3742sC+F0rZ9CJiSeUUcnN2LtrN0Efe6n+kMRcifnw1 BBJ4dsF7kyZBKojVlbzVtKQw9Alh665MkECso9umElpuQg8J+QHMGR/kDAOA9IyM RsjC6Ai2x+aSyliVyPFOL9bWDh0p/sX2mvqndFQ/X5ITRGMURm/Nmh6YeUL41x5u YqDO414CmaxwdNLfz4or/m2HmU5EU4TQBmIgOZZP3UhfqNrB6H6dt4/jVl71GU5D N1zHcOEypvSen4koDj6l6y2m9DJ/iYANkqGZf5BCZyTRcgxwagC4IQ3VjNU6FT81 cMizMTVZzNYEua3vL8n4aOXHk8cn1G68PYCuRC5UwOLez0OsCvYl5QkS+uGSLrUf uz55VWgbZQ9hniLDarA6cJTCASYO7fbz3uwJID8T/3VFFWei6uumI2sxRtQJtc5z MhTLGQIcJJ7ptFCCulwTGsicIU52X5ixPcN+VnEbFrFb74uqZQLVj6FN19e82r4l OQ8xhZxFQUwCc8g+MqoA =YSpn -----END PGP SIGNATURE-----

1 0

Re: "What does GCHQ know about our devices that we don't?"
by coderman 24 May '14

24 May '14

per discussion at https://www.privacyinternational.org/blog/what-does-gchq-know-about-our-dev… , there were a number of chips destroyed during the GCHQ zeroisation debacle. - keyboard controller chip - trackpad controller chip - inverting converter chip this is the type of covert implant hardware you would request destroyed rather than leave in the hands of an adversary. to be clear, this was not about reclaiming storage on secondary devices on a system, but about covering the tracks left on already compromised systems.

1 0

Re: Going to jail nowadays for owning a book, wtf?
by tpb-crypto＠laposte.net 22 May '14

22 May '14

A friend of ours sent me this very intredasting link which I didn't know existed. But since cross-posting is a no-no, I take the liberty to post the information which is obviously very pertinent in our discussion: > > Things like that remember me that google once did not have the capacity to > > exclude links from its systems, but because of pedophiles, they finally > > built that capacity. The next day the copyright industry was knocking at > > their door to take down content they previously couldn't because of the > > lack of technical capacity. > > > > "Now Google don't have excuses." - I remember seeing that phrase in a New > > York magazine. > > ”Child pornography is great,” the speaker at the podium declared > enthusiastically. ”It is great because politicians understand child > pornography. By playing that card, we can get them to act, and start blocking > sites. And once they have done that, we can get them to start blocking file > sharing sites”. > -- http://christianengstrom.wordpress.com/2010/04/27/ifpis-child-porn-strategy/ >

1 0