- cypherpunks - lists.cpunks.org

Fwd: Secrets, lies and Snowden's email: why I was forced to shut down Lavabit
by Ulex Europae 21 May '14

21 May '14

Secrets, lies and Snowden's email: why I was forced to shut down Lavabit For the first time, the founder of an encrypted email startup that was supposed to insure privacy for all reveals how the FBI and the US legal system made sure we don't have the right to much privacy in the first place By Ladar Levison May 20 2014 <http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-d…> My legal saga started last summer with a knock at the door, behind which stood two federal agents ready to to serve me with a court order requiring the installation of surveillance equipment on my company's network. My company, Lavabit, provided email services to 410,000 people including Edward Snowden, according to news reports and thrived by offering features specifically designed to protect the privacy and security of its customers. I had no choice but to consent to the installation of their device, which would hand the US government access to all of the messages to and from all of my customers as they travelled between their email accounts other providers on the Internet. But that wasn't enough. The federal agents then claimed that their court order required me to surrender my company's private encryption keys, and I balked. What they said they needed were customer passwords which were sent securely so that they could access the plain-text versions of messages from customers using my company's encrypted storage feature. (The government would later claim they only made this demand because of my "noncompliance".) Bothered by what the agents were saying, I informed them that I would first need to read the order they had just delivered and then consult with an attorney. The feds seemed surprised by my hesitation. What ensued was a flurry of legal proceedings that would last 38 days, ending not only my startup but also destroying, bit by bit, the very principle upon which I founded it that we all have a right to personal privacy. In the first two weeks, I was served legal papers a total of seven times and was in contact with the FBI every other day. (This was the period a prosecutor would later characterize as my "period of silence".) It took a week for me to identify an attorney who could adequately represent me, given the complex technological and legal issues involved and we were in contact for less than a day when agents served me with a summons ordering me to appear in a Virginia courtroom, over 1,000 miles from my home. Two days later, I was served the first subpoena for the encryption keys. With such short notice, my first attorney was unable to appear alongside me in court. Because the whole case was under seal, I couldn't even admit to anyone who wasn't an attorney that I needed a lawyer, let alone why. In the days before my appearance, I would spend hours repeating the facts of the case to a dozen attorneys, as I sought someone else that was qualified to represent me. I also discovered that as a third party in a federal criminal indictment, I had no right to counsel. After all, only my property was in jeopardy not my liberty. Finally, I was forced to choose between appearing alone or facing a bench warrant for my arrest. In Virginia, the government replaced its encryption key subpoena with a search warrant and a new court date. I retained a small, local law firm before I went back to my home state, which was then forced to assemble a legal strategy and file briefs in just a few short days. The court barred them from consulting outside experts about either the statutes or the technology involved in the case. The court didn't even deliver transcripts of my first appearance to my own lawyers for two months, and forced them to proceed without access to the information they needed. Then, a federal judge entered an order of contempt against me without even so much as a hearing. [snip]

3 3

scrypt and ASICs
by coderman 16 May '14

16 May '14

the other thread mentioned the "ASIC-able" ness of scrypt. what techniques may be used to make scrypt even harder to put on die? (is this an arms race between transistor count and algorithm tuneables?)

3 2

Observation re gmail/google cookies
by grarpamp 16 May '14

16 May '14

Is used to be such that only the mail.google.com:GX cookie was required to access webgmail (even if it added a number of other cookies post that access, they could be reasonably narrowed down and blocked to just mail.google.com, if I recall). Now within the past many months that has changed to include, at minimum, myriad cookies in google.com. (I've not tested which are the minimum set). These will potentially cross with ads and other tracking things. While great for google integration, it's bad for user privacy regarding domain/usage segregation. Do not trust the google in your browser anymore. As if, ever, obviously.

4 3

Re: "SIGINT tradecraftis very hands-on (li terally!)"
by John Young 15 May '14

15 May '14

There is a good chance the documents are covertly marked as you suggest, the ostentatious classification markings a ruse for untutored yokels to fancy are genuine. Covert markings have been in use for a long time, as well as ostentatious markings. On paper as well as digital and other forms of electronic. And certainly packets carry unique markings in a variety of overt and covert types. Some of the techniques fall under the inadvertent emanations rubric associated with Tempest -- which has blossomed well beyond the FOIA releases from the late 1990s. TSCM is a marvel of duplicity and ruse. At 08:16 PM 5/13/2014, you wrote: >From: Black Fox <fox(a)vbfox.net> >On Tue, May 13, 2014 at 2:58 PM, coderman ><<mailto:coderman@gmail.com>coderman(a)gmail.com> wrote: > > On Tue, May 13, 2014 at 1:00 AM, John Young > <<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: > >> > We've seen the Greenwald book No Place to Hide, where are the > >> > promised gush of Snowden documents available? His publisher > >> > doesn't show a source. Surely not another marketing tease. > >> great question; let us know if you find them! > ><http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.p > df>http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf > >If I were the telephone company from which the records were >requested, I'd note that the records were requested in "electronic" >format. Then, I'd ask a programmer to write a program to write a >program to generate pdf files with embedded "captcha"-type >text: Images that are quite apparent to the human eye, but are very >difficult for any computer to make any sense of. All the phone >records would be there (in no particular order), and they'd all be >very readable to humans, but... > Jim Bell >

3 2

Re: "SIGINT tradecraftis very hands-on (l i terally!)"
by John Young 14 May '14

14 May '14

That would be quite useful. How would you crack it if used by an opponent? At 01:11 AM 5/14/2014, you wrote: >Alright, what I meant was this: The judge ordered that the >information be provided in electronically-readable form. He meant, >"not on paper", because if it were on paper, that would be very >difficult to actually USE. My idea was to put the information onto >pdf files, where if you view the pdf file, it would look like lines >of "captcha"-type data: Weird, warped characters, in various odd >colors, overlapping lines, >etc. <http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, >the free encyclopedia Specifically designed to NOT be >computer-identifiable. The essence of the presentation of the data >would be that it wouldn't be readable by 'computer' at all; it would >have to be decoded by human intervention...even though it was in >"electronically-readable form"!! > ><http://en.wikipedia.org/wiki/Captcha> >image > ><http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, the free >encyclopedia >A CAPTCHA (an acronym for "Completely Automated Public Turing test >to tell Computers and Humans Apart") is a type of challenge-respons... ><http://en.wikipedia.org/wiki/Captcha>View on en.wikipedia.org >Preview by Yahoo > Jim Bell

3 3

cypherpunks administrivia: no more reply-to header stripping
by Riad S. Wahby 14 May '14

14 May '14

Folks, Until now, mailman has been stripping Reply-To: headers from messages to the list. I've just turned this off. Some webmail services (notably, Yahoo!) set the Reply-To: header and include it in the headers signed with DKIM. Stripping Reply-To: thus breaks the DKIM signature. In the case of Yahoo! this signature breakage is especially problematic, because their DMARC policy is set to reject. (In other words, messages with yahoo.com in the From: header that fail both SPF and DKIM should be rejected by compliant mail services, e.g., AOL, Gmail, Hotmail, Yahoo!) Messages to the mailing list should pass SPF, since the envelope sender domain for list messages is cpunks.org and I publish an appropriate spf RR. However, any list subscriber who forwards mail to another account will have broken SPF and an invalid DKIM signature, which trips the DMARC policy and causes delivery failures. I realize that this might cause some inconvenience, but I would prefer to err on the side of successfully delivering messages whenever possible. If you're using procmail and prefer the old behavior, the following recipe should suffice: :0H * ^list-id.*cypherpunks.cpunks.org | formail -IReply-To -=rsw

1 0

Re: "SIGINT tradecraftis very hands-on (literally!)"
by John Young 14 May '14

14 May '14

We've seen the Greenwald book No Place to Hide, where are the promised gush of Snowden documents available? His publisher doesn't show a source. Surely not another marketing tease. Surely not snatched by the TLAs, tampered with, doctored, MTM'd, redacted, censored, cherry-picked, highlighted for dummies and fans, surely not handled like a disinfo spy op, heavy on narrative, suggestions of much more unreleasable, need for classified briefings and diligent vetting, that what we documents censors know we can't dare tell the public due to the public dupery by enemies of our interests. Dropboxes are honey pots, media is just that, governments are just that, opsec and comsec are just that. And do tell, what is this SIGINT forum psyoping? At 03:11 AM 5/13/2014, you wrote: >there's some new thing out, > > ... first shots from the peanut gallery? > >please report suspicious network behavior accessing Snowden documents >to the second hand exploit sale broker consortium for a reasonable >referral fee! > > >best regards,

6 5

Patented prime numbers
by Georgi Guninski 13 May '14

13 May '14

Probably this is well known. http://www.freepatentsonline.com/5373560.html http://mathworld.wolfram.com/PrimeNumber.html (check (3)) > Because of their importance in encryption algorithms such as RSA encryption, prime numbers can be important commercial commodities. In fact, R. Schlafly (1994) has obtained U.S. Patent 5373560 on the following two primes (expressed in hexadecimal notation): fuck, fuck, fuck.

6 10

Re: [p2p-hackers] How do BitTorrent block lists get created?
by grarpamp 13 May '14

13 May '14

On Mon, May 12, 2014 at 1:09 PM, David Barrett <dbarrett(a)quinthar.com> wrote: > connecting to everybody in a swarm, downloading one block, > and automatically sending out a takedown Beyond that (which few if any seem to be doing in the first place), they have to prove the content and custody chain of that block, etc. A difficult and costly bar for typical enforcement trolls. > effectively monitor and police all the top torrents out there Any torrent out there. > the enforcer would never send you a block of valid data They own it, they'll do whatever they want with it. You forget, the few random blocks they choose to send are worthless to them, yet scaring you into settling for serving them back out is pure profit. You're also confusing the lesser/non issue of downloading blocks with serving blocks. The latter is better known as the actual regulated infringing activity. > The only defense Bittorrent has is the "blocklist" Now the fun part... have you guys gone daft? Blocklists and VPN's as best defense against such 'enforcement', really? Really?!! Isn't it about time you all plugged your client in to some anonymous overlay network like I2P, Tor, Phantom, cjdns, whatever and just forget about the issue once and for all? Oh, yeah, I forgot, you have: - no patience and need your DL right fucking now. (anon 'swarms' are not really slow at all) - no money and so you leech bandwidth instead of buying clear bandwidth to support whatever anon overlay you're using. (rate limits on linux/bsd are actually easy) Have fun with your clearnet thing, you get what you asked for. > In a recent conversation about piracy and whether it could win Old school battles don't necessarily win the war, sometimes all it takes is lots of voices in anon yet visible protest.

2 1

"SIGINT tradecraft…is very hands-on (literally!)"
by coderman 13 May '14

13 May '14

there's some new thing out, ... first shots from the peanut gallery? please report suspicious network behavior accessing Snowden documents to the second hand exploit sale broker consortium for a reasonable referral fee! best regards,

4 3