- cypherpunks - lists.cpunks.org

scrypt and ASICs
by coderman 16 May '14

16 May '14

the other thread mentioned the "ASIC-able" ness of scrypt. what techniques may be used to make scrypt even harder to put on die? (is this an arms race between transistor count and algorithm tuneables?)

3 2

Observation re gmail/google cookies
by grarpamp 16 May '14

16 May '14

Is used to be such that only the mail.google.com:GX cookie was required to access webgmail (even if it added a number of other cookies post that access, they could be reasonably narrowed down and blocked to just mail.google.com, if I recall). Now within the past many months that has changed to include, at minimum, myriad cookies in google.com. (I've not tested which are the minimum set). These will potentially cross with ads and other tracking things. While great for google integration, it's bad for user privacy regarding domain/usage segregation. Do not trust the google in your browser anymore. As if, ever, obviously.

4 3

Re: "SIGINT tradecraftis very hands-on (li terally!)"
by John Young 15 May '14

15 May '14

There is a good chance the documents are covertly marked as you suggest, the ostentatious classification markings a ruse for untutored yokels to fancy are genuine. Covert markings have been in use for a long time, as well as ostentatious markings. On paper as well as digital and other forms of electronic. And certainly packets carry unique markings in a variety of overt and covert types. Some of the techniques fall under the inadvertent emanations rubric associated with Tempest -- which has blossomed well beyond the FOIA releases from the late 1990s. TSCM is a marvel of duplicity and ruse. At 08:16 PM 5/13/2014, you wrote: >From: Black Fox <fox(a)vbfox.net> >On Tue, May 13, 2014 at 2:58 PM, coderman ><<mailto:coderman@gmail.com>coderman(a)gmail.com> wrote: > > On Tue, May 13, 2014 at 1:00 AM, John Young > <<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: > >> > We've seen the Greenwald book No Place to Hide, where are the > >> > promised gush of Snowden documents available? His publisher > >> > doesn't show a source. Surely not another marketing tease. > >> great question; let us know if you find them! > ><http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.p > df>http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf > >If I were the telephone company from which the records were >requested, I'd note that the records were requested in "electronic" >format. Then, I'd ask a programmer to write a program to write a >program to generate pdf files with embedded "captcha"-type >text: Images that are quite apparent to the human eye, but are very >difficult for any computer to make any sense of. All the phone >records would be there (in no particular order), and they'd all be >very readable to humans, but... > Jim Bell >

3 2

Re: "SIGINT tradecraftis very hands-on (l i terally!)"
by John Young 14 May '14

14 May '14

That would be quite useful. How would you crack it if used by an opponent? At 01:11 AM 5/14/2014, you wrote: >Alright, what I meant was this: The judge ordered that the >information be provided in electronically-readable form. He meant, >"not on paper", because if it were on paper, that would be very >difficult to actually USE. My idea was to put the information onto >pdf files, where if you view the pdf file, it would look like lines >of "captcha"-type data: Weird, warped characters, in various odd >colors, overlapping lines, >etc. <http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, >the free encyclopedia Specifically designed to NOT be >computer-identifiable. The essence of the presentation of the data >would be that it wouldn't be readable by 'computer' at all; it would >have to be decoded by human intervention...even though it was in >"electronically-readable form"!! > ><http://en.wikipedia.org/wiki/Captcha> >image > ><http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, the free >encyclopedia >A CAPTCHA (an acronym for "Completely Automated Public Turing test >to tell Computers and Humans Apart") is a type of challenge-respons... ><http://en.wikipedia.org/wiki/Captcha>View on en.wikipedia.org >Preview by Yahoo > Jim Bell

3 3

cypherpunks administrivia: no more reply-to header stripping
by Riad S. Wahby 14 May '14

14 May '14

Folks, Until now, mailman has been stripping Reply-To: headers from messages to the list. I've just turned this off. Some webmail services (notably, Yahoo!) set the Reply-To: header and include it in the headers signed with DKIM. Stripping Reply-To: thus breaks the DKIM signature. In the case of Yahoo! this signature breakage is especially problematic, because their DMARC policy is set to reject. (In other words, messages with yahoo.com in the From: header that fail both SPF and DKIM should be rejected by compliant mail services, e.g., AOL, Gmail, Hotmail, Yahoo!) Messages to the mailing list should pass SPF, since the envelope sender domain for list messages is cpunks.org and I publish an appropriate spf RR. However, any list subscriber who forwards mail to another account will have broken SPF and an invalid DKIM signature, which trips the DMARC policy and causes delivery failures. I realize that this might cause some inconvenience, but I would prefer to err on the side of successfully delivering messages whenever possible. If you're using procmail and prefer the old behavior, the following recipe should suffice: :0H * ^list-id.*cypherpunks.cpunks.org | formail -IReply-To -=rsw

1 0

Re: "SIGINT tradecraftis very hands-on (literally!)"
by John Young 14 May '14

14 May '14

We've seen the Greenwald book No Place to Hide, where are the promised gush of Snowden documents available? His publisher doesn't show a source. Surely not another marketing tease. Surely not snatched by the TLAs, tampered with, doctored, MTM'd, redacted, censored, cherry-picked, highlighted for dummies and fans, surely not handled like a disinfo spy op, heavy on narrative, suggestions of much more unreleasable, need for classified briefings and diligent vetting, that what we documents censors know we can't dare tell the public due to the public dupery by enemies of our interests. Dropboxes are honey pots, media is just that, governments are just that, opsec and comsec are just that. And do tell, what is this SIGINT forum psyoping? At 03:11 AM 5/13/2014, you wrote: >there's some new thing out, > > ... first shots from the peanut gallery? > >please report suspicious network behavior accessing Snowden documents >to the second hand exploit sale broker consortium for a reasonable >referral fee! > > >best regards,

6 5

Patented prime numbers
by Georgi Guninski 13 May '14

13 May '14

Probably this is well known. http://www.freepatentsonline.com/5373560.html http://mathworld.wolfram.com/PrimeNumber.html (check (3)) > Because of their importance in encryption algorithms such as RSA encryption, prime numbers can be important commercial commodities. In fact, R. Schlafly (1994) has obtained U.S. Patent 5373560 on the following two primes (expressed in hexadecimal notation): fuck, fuck, fuck.

6 10

Re: [p2p-hackers] How do BitTorrent block lists get created?
by grarpamp 13 May '14

13 May '14

On Mon, May 12, 2014 at 1:09 PM, David Barrett <dbarrett(a)quinthar.com> wrote: > connecting to everybody in a swarm, downloading one block, > and automatically sending out a takedown Beyond that (which few if any seem to be doing in the first place), they have to prove the content and custody chain of that block, etc. A difficult and costly bar for typical enforcement trolls. > effectively monitor and police all the top torrents out there Any torrent out there. > the enforcer would never send you a block of valid data They own it, they'll do whatever they want with it. You forget, the few random blocks they choose to send are worthless to them, yet scaring you into settling for serving them back out is pure profit. You're also confusing the lesser/non issue of downloading blocks with serving blocks. The latter is better known as the actual regulated infringing activity. > The only defense Bittorrent has is the "blocklist" Now the fun part... have you guys gone daft? Blocklists and VPN's as best defense against such 'enforcement', really? Really?!! Isn't it about time you all plugged your client in to some anonymous overlay network like I2P, Tor, Phantom, cjdns, whatever and just forget about the issue once and for all? Oh, yeah, I forgot, you have: - no patience and need your DL right fucking now. (anon 'swarms' are not really slow at all) - no money and so you leech bandwidth instead of buying clear bandwidth to support whatever anon overlay you're using. (rate limits on linux/bsd are actually easy) Have fun with your clearnet thing, you get what you asked for. > In a recent conversation about piracy and whether it could win Old school battles don't necessarily win the war, sometimes all it takes is lots of voices in anon yet visible protest.

2 1

"SIGINT tradecraft…is very hands-on (literally!)"
by coderman 13 May '14

13 May '14

there's some new thing out, ... first shots from the peanut gallery? please report suspicious network behavior accessing Snowden documents to the second hand exploit sale broker consortium for a reasonable referral fee! best regards,

4 3

Update: please remain vulnerable if the laws of your jurisdiction require it! [was: So You Like Pain and Vulnerability Management?]
by coderman 13 May '14

13 May '14

On Mon, May 12, 2014 at 8:47 PM, coderman <coderman(a)gmail.com> wrote: > ... > 1. "You can’t manage vulnerabilities in closed software any more than > you can manage tunnel construction in an ant nest." please note that my reply below is illegal to follow in some parts of the world: > this is not true. by actively managing the execution of all processes > on all your systems and the communication they make ... > blocking and altering shared library methods, system calls, and > network communication... a friend of mine was just arrested outside the Louvre for strace like behavior![0] best regards, 0. "Did you know? ... strace is banned in France, where it is classified as a cracking tool (it can trace plain-text I/O)." http://www.brendangregg.com/blog/2014-05-11/strace-wow-much-syscall.html P.S. no of course it was not Pete, and of course it was not my code.

1 0