- cypherpunks - lists.cpunks.org

48 Minute Video of NSA DDIR John Inglis at NYU 19 November 2019
by John Young 19 Nov '13

19 Nov '13

http://www.youtube.com/watch?v=6ydkw4xgZ-Y&feature=c4-overview&list=UURwhQQ…

1 0

RetroShare
by rysiek 19 Nov '13

19 Nov '13

OHAI, So, this project has been noted here on several occasions, but I still lack some serious opinions. Here's a chance to voice them. What do you think of RetroShare? http://en.wikipedia.org/wiki/Retroshare http://retroshare.sourceforge.net/ inb4 "Java suxxorz" -- yes, I tend to hold that view myself; hoever, if RetroShare is a workable solution, we can simply add C++/Python/Whatever implementations later, right? -- Pozdr rysiek

6 13

Re: [guardian-dev] Lavabit's Dark Mail Initiative
by elijah 19 Nov '13

19 Nov '13

On 11/18/2013 09:37 AM, Josh Steiner wrote: > http://www.kickstarter.com/projects/ladar/lavabits-dark-mail-initiative > > Basically, it is an initiative to open source the lavabit's internal > code and turn it into a new secure mail protocol they are calling > "Dark Mail" The really annoying thing is that lavabit's platform and Dark Mail are totally incompatible and have nothing to do with one another. So the kickstarter is meaningless. * lavabit's prior software allowed the service provider to encrypt a user's IMAP disk storage individually to the password of the user. * darkmail is a project driven mostly by silentcircle that is to create something entirely new that is email-like, but not email. In case you missed it, moxie did a pretty good job explaining why lavabit's old code should die and should most definitely NOT be open sourced or used by anyone: http://www.thoughtcrime.org/blog/lavabit-critique/ This critique was later posted to arstechnica, and then later there was an exchange on reddit under Ladar's AMA in which Ladar doubled down on his completely unjustified claims and Moxie doubled down on lavabit being total snakeoil: http://www.reddit.com/r/IAmA/comments/1qetvk/i_am_ladar_levison_owner_and_o… It is not pretty. Moxie is correct, of course, but a valid defense of the lavabit model would have been to talk about how US law treats data at rest very differently than data in transit. This was not the approach Ladar pursued. It does not totally matter, because that potential justification doesn't hold true anymore based on what we now know. So, really, there is no justification for making the lavabit approach open source. The darkmail project is interesting in that they have promised all things to all people: * end-to-end client-side encryption * automatic management of keys * not email, but xmpp used in an email-like way * but maybe also gateways to email for backward compatibility * asynchronous forward secrecy and metadata protection via SCIMP 2.0 * thunderbird extension * local imap & smtp server so you can use existing mail user agent * open protocol and open source code so anyone can adopt * tools to make it easy for a service provider to use Because we don't have any details yet on darkmail it is impossible to critique. What we do know is that SCIMP 1.0 doesn't have the properties that are promised, and they can't be added without basically a whole new protocol. But I think darkmail is exciting and is making the right promises (total end-to-end security). I certainly hope they will answer my emails :) Of course, LEAP (https://leap.se/email) already does almost everything that darkmail wants to do, with the one caveat that currently we use SMTP exclusively and rely on the service provider for PFS and metadata protection (although we have a plan to fix this in the future). -elijah _______________________________________________ Guardian-dev mailing list Post: Guardian-dev(a)lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To Unsubscribe Send email to: Guardian-dev-unsubscribe(a)lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/eugen%40leitl.org You are subscribed as: eugen(a)leitl.org

1 0

SOS
by Lilith Lela 18 Nov '13

18 Nov '13

Hi, We received a request from https://twitter.com/S0Sph for us using and recommending this site/service http://sos.ph/ Earlier, a few weeks ago, I had been briefly looking at this https://cryptostorm.is/ These darknet tokens. R it useful in activist contexts? What you think? Got perhaps (external to this service(s)) links and/or insights for us so we can figure out how it works exactly, and what its vulnerabilities r? Cheers, Lilith

2 2

Re: [coreboot] BadBIOS Thoughts
by Patrick Georgi 18 Nov '13

18 Nov '13

Am 17.11.2013 21:46, schrieb Alex: > [Broken record warning] What if, somehow, the community gathered a few > brains, talked to a vendor, and convinced them to put coreboot on a > yet-to-be-released product? It would almost seem like the community > would do most of the work for free. What sort of responses have we > received in the past with this approach? System 76, ThinkPenguin, > Pudget, etc... have we tried any of them? They have sleek systems, and > at least the first two value openness more than the average. Those three list Intel based notebooks only (not even a token AMD device). From the point of view of free firmware, all of them are unsuitable, since free (and open, and trustable) Intel firmware implementations are only available for museum class^W^Wlong-term support hardware. I think the only x86 notebook with completely free firmware these days that can be bought easily is http://shop.gluglug.org.uk/product/ibm-lenovo-thinkpad-x60-coreboot/ (featuring those Intel museum chips) And I guess doing something like that group is the only working approach for now: Pick some notebook (something recent), free its firmware, sell the pre-modded boxes (and publish numbers!). If you manage to sell significant volumes (which shouldn't be all that large), that might turn some heads. There are some issues with this approach: You're limited in your choice of base hardware (likely AMD/Via chipsets only, the EC must be manageable with reasonable effort) and it must be available for some time (no fun doing a port for 2 months, then selling the notebook for another 4, after which it's taken off the market, and you have to start from scratch). And, of course, when doing this, you carry the usual entrepreneurial risk. Patrick -- coreboot mailing list: coreboot(a)coreboot.org http://www.coreboot.org/mailman/listinfo/coreboot

1 0

Re: [serval-project-dev] how to get best voice quality with low end phones?
by Jeremy Lakeman 18 Nov '13

18 Nov '13

3s of lag seems a bit on the high side. Using cheap huawei's here in the lab, we typically see about 250-500ms of lag. Note that the cheap huawei's seem to have a 2KB hardware audio buffer, leading to (2KB / 16bit 8KHz ~=) 120ms of jitter that we can't do anything about. We'd like to implement some kind of echo canceler, but we haven't found anything that would be trivial to drop in. Our jitter buffer could probably use some improvements, I'm not going to say that it is in any way ideal. We're not managing network buffer bloat right now. When the wifi channel is busy, the rate that the kernel will send packets drops and can easily start to back up in the network stack. This can add a significant amount of latency. If packets don't arrive in time, the link state routing engine may be dropping the link, which would limit the number of outgoing packets, which would drop the latency, and the link would come back up again... We should be using RTT estimates to throttle our transmit rate to keep latency low, and feed into our link state calculations to work out when a link is really dead, or everything on that interface is just slow. But we haven't built anything like that yet. If we were limiting our transmit rate better, instead of sending lots of small UDP packets, we would try to aggregate more voice packets per UDP frame. Hopefully allowing the voice call to continue, just with higher jitter. Rhizome, and hence messaging, doesn't care as much if the network path is unstable. And it will just keep on trying until it gets there, making messaging *much* more reliable. We have some rough plans to implement a combination of push-to-talk / voicemail, using rhizome. And built into the messaging UI. But we don't have any concrete plans to start this work right now. And one day we may implement a form of network coding to reduce the number of packets required for bi-directional traffic over multiple hops. On Mon, Nov 18, 2013 at 4:21 PM, Miles <myles(a)tenhand.com> wrote: > > I've been testing with a pair of huawei 8150s using the stock gingerbread > to connect to a 703n mesh extender. Wifi on the phones is pretty poor and > my area is RF-noisy, so wifi works to about 2 blocks line of sight. I'm > using about a 2 week old nightly build of the batphone app. > > When the signal is strong, the phone works with about 3 seconds of audio > delay and noticeable echo. When the wifi gets poor & drops to 2mb, voice > cuts out entirely. text continues to work until wifi drops. Amusingly, > voice calls drop at about the limits of my shouting voice. > > Some of the problem is probably background /wind noise. I'd love a mute > button on the batphone. > > What should I do to improve voice experience , short of souping up the > mesh extender? Do you usually use headsets? With PTT? > > -- > You received this message because you are subscribed to the Google Groups > "Serval Project Developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to serval-project-developers+unsubscribe(a)googlegroups.com. > To post to this group, send email to > serval-project-developers(a)googlegroups.com. > Visit this group at > http://groups.google.com/group/serval-project-developers. > For more options, visit https://groups.google.com/groups/opt_out. > -- You received this message because you are subscribed to the Google Groups "Serval Project Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to serval-project-developers+unsubscribe(a)googlegroups.com. To post to this group, send email to serval-project-developers(a)googlegroups.com. Visit this group at http://groups.google.com/group/serval-project-developers. For more options, visit https://groups.google.com/groups/opt_out.

1 0

Re: Request for transcript: "Writers Especially Concerned About NSA Actions"
by John Young 18 Nov '13

18 Nov '13

That herd behavior is disappointing but customary cowardice. Worse happened after 9/11. Many once valiant FOI fighters cleansed their websites and heralded the need to obey the war-mongerers, and urgently cautioned others as if the propaganda was believable. No doubt, this self-censorship is market-driven to please funders, advertizers and publishers who dare not displease their dinner companions at Aspen, Davos, Bohemian Grove, and for sure the DC centroid of privileged access to valuable information, much of it spy boosting leakage of the Snowden type. The heavy censorship of the Snowden documents by the hoarders and their extremely slow pace of release while rhetorizing and hyping the minimalist product fits this spy-favorite marketing schemata. NPR is not what it used to appear to be. It has booted and censored a slew of its reporters, editors and contributors. Not alone, the journalism industry is panicked at loss of customers and is rushing to cleanse its harem. Poor discards are deperately seeking Omidyar and Soros invitation to their opium dens as if from frying pan into the fire. At 12:08 PM 11/17/2013, you wrote: >I think what you're looking for is here. > >http://www.npr.org/templates/story/story.php?storyId=245660885 > >On Sat, Nov 16, 2013 at 3:21 PM, coderman <coderman(a)gmail.com> wrote: > > Anyone have a transcript for this piece? > > > > --- > > > > "Writers Especially Concerned About NSA Actions" > > http://www.npr.org/templates/story/story.php?storyId=245660885 > > > > While polls show many Americans are uneasy with government actions > > revealed by NSA leaker Edward Snowden, one profession in particular > > seems to be alarmed. A new survey of professional writers finds them > > much more concerned than the general public. An organization of > > writers says that a large majority of its members have "never been as > > worried about privacy rights and freedom of the press as they are > > today." > > > >-- >Christopher Nielsen >"They who can give up essential liberty for temporary safety, deserve >neither liberty nor safety." --Benjamin Franklin >"The tree of liberty must be refreshed from time to time with the >blood of patriots & tyrants." --Thomas Jefferson

3 2

Re: passwords! (p5) / ngrams and passphrases
by coderman 18 Nov '13

18 Nov '13

On Fri, Nov 15, 2013 at 6:09 PM, brian carroll <electromagnetize(a)gmail.com> wrote: > ... if a password service used this principle,... 3-4 sets instead, > themselves having special rules... > > [set1|set2|set3|set4] > > in this way, a 'rolling password' could be developed ... this feels similar to various guided / ordered permutations strategies that use a corpus of ngrams or words for attacking longer sequences, like passphrases. [with or without decorating permutations like appended numerical sequences and other common substitutions and sequences] the effectiveness of these in practice appears strongly bound to your operational security. e.g. past examples of mining a user's interests to guide successful pass word and pass phrase cracking attempts. i keep waiting for someone to write it, alas: 'No results found for "the art of tactical password cracking"' ;)

1 0

Fwd: That wonderful 1980-ies hippie vibe...
by coderman 18 Nov '13

18 Nov '13

---------- Forwarded message ---------- From: Poul-Henning Kamp <phk(a)phk.freebsd.dk> Date: Sun, Nov 17, 2013 at 2:53 PM Subject: That wonderful 1980-ies hippie vibe... To: HTTP Working Group <ietf-http-wg(a)w3.org> It's bedtime here in Denmark, but before I go to bed, I want to thank for the wonderful 1980'ies hippie-vibe of the last couple of days, it's been a wonderful nostalgic experience. I don't know how many of you remember "atomic weapon free zones" ? Maybe if you are younger, you might have seen a faded "Atomic Weapon free Zone" sign somewhere ? What happened was that well-meaning city councils made lofty proclamations and declared there city would never allow atomic weapons inside city limits etc. It was of course an empty gesture, it's not like the military cared what the Burgermeister of some dutch or german town signed, if they needed to drive their nukes through, they would damn well drive their nukes through the town-square. In some cases it was down-right laughably hypocritical. Does Berkeley still have their sign up ? Berkeley Uni made a fortune running LLNL, which designed atomic bombs, but they were appearantly not allowed to bring the work home with them, or something. Anyway... Ending the cold war, one nuclear-weapon free city after the other, was as effective as slightly more encryption in HTTP/2.0 will be at ending USAs "War Against Privacy". I do understand you are upset about it, so am I, and I do recognize that when you have only a watchmakers screwdriver as tool, you use the only tool you have. But rolling back the US police-state, a firmly nailed down military-industrial complex with a budget measured in billions, and what looks like almost unanimous political support of USgov, is not going to happen because we tighten a screw somewhere in a internet protocol. Sorry. If you want to do something about the polic-state, by all means get involved in politics: Expose the lies, support the whistleblowers, vote the bums out, run for office. But in this WG, please leave your politics at the door and concentrate on the objective in our charter: Making a better performing HTTP protocol. G'night... -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk(a)FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence.

1 0

Denial of Disservice Attack [was: Jeremy Hammond Banned from using Cryptography]
by coderman 18 Nov '13

18 Nov '13

On Sun, Nov 17, 2013 at 11:31 AM, Jim Bell <jamesdbell8(a)yahoo.com> wrote: > ... >>Jim Bell's exhortations to deny all pleas a hard sell considering that >>one in four rolls over completely under pressure. :/ > > For 70,000 Federal criminal defendants per year, there are only about 3,500 > Federal criminal trials per year. In other words, ultimately 95% 'rolls > over'. (Note: That doesn't mean that they necessarily 'rat': Many > defendants have no co-defendants, for example. And, a defendant might > accept a plea, without agreement to testify against someone else.) With my > idea of "Denial of Disservice Attack" (Offer of circa $5,000 to demand a > jury trial), I'm trying to avoid that situation. agreed; i should have said "turned rat fuck" instead of "rolled over completely". accepting a plea more apropos "rolling over"... on a related note, how deep can the court queue grow before it becomes untenable and denies prosecutions? the recent civil court delays appear to be trivial despite cries of dire circumstance...[0] 0. "For Federal Courts, Shutdown Caused Broad Disruptions" [ED: for generous interpretation of "broad disruption"] http://news.uscourts.gov/federal-courts-shutdown-caused-broad-disruptions [ED2: more comedy, e.g. 'after 17 days delay, “the general impression was that federal courts were on their last breath,”' - LULZ]

1 0