- cypherpunks - lists.cpunks.org

Re: "What does GCHQ know about our devices that we don't?"
by coderman 24 May '14

24 May '14

per discussion at https://www.privacyinternational.org/blog/what-does-gchq-know-about-our-dev… , there were a number of chips destroyed during the GCHQ zeroisation debacle. - keyboard controller chip - trackpad controller chip - inverting converter chip this is the type of covert implant hardware you would request destroyed rather than leave in the hands of an adversary. to be clear, this was not about reclaiming storage on secondary devices on a system, but about covering the tracks left on already compromised systems.

1 0

Re: Going to jail nowadays for owning a book, wtf?
by tpb-crypto＠laposte.net 22 May '14

22 May '14

A friend of ours sent me this very intredasting link which I didn't know existed. But since cross-posting is a no-no, I take the liberty to post the information which is obviously very pertinent in our discussion: > > Things like that remember me that google once did not have the capacity to > > exclude links from its systems, but because of pedophiles, they finally > > built that capacity. The next day the copyright industry was knocking at > > their door to take down content they previously couldn't because of the > > lack of technical capacity. > > > > "Now Google don't have excuses." - I remember seeing that phrase in a New > > York magazine. > > ”Child pornography is great,” the speaker at the podium declared > enthusiastically. ”It is great because politicians understand child > pornography. By playing that card, we can get them to act, and start blocking > sites. And once they have done that, we can get them to start blocking file > sharing sites”. > -- http://christianengstrom.wordpress.com/2010/04/27/ifpis-child-porn-strategy/ >

1 0

Fwd: Secrets, lies and Snowden's email: why I was forced to shut down Lavabit
by Ulex Europae 21 May '14

21 May '14

Secrets, lies and Snowden's email: why I was forced to shut down Lavabit For the first time, the founder of an encrypted email startup that was supposed to insure privacy for all reveals how the FBI and the US legal system made sure we don't have the right to much privacy in the first place By Ladar Levison May 20 2014 <http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-d…> My legal saga started last summer with a knock at the door, behind which stood two federal agents ready to to serve me with a court order requiring the installation of surveillance equipment on my company's network. My company, Lavabit, provided email services to 410,000 people including Edward Snowden, according to news reports and thrived by offering features specifically designed to protect the privacy and security of its customers. I had no choice but to consent to the installation of their device, which would hand the US government access to all of the messages to and from all of my customers as they travelled between their email accounts other providers on the Internet. But that wasn't enough. The federal agents then claimed that their court order required me to surrender my company's private encryption keys, and I balked. What they said they needed were customer passwords which were sent securely so that they could access the plain-text versions of messages from customers using my company's encrypted storage feature. (The government would later claim they only made this demand because of my "noncompliance".) Bothered by what the agents were saying, I informed them that I would first need to read the order they had just delivered and then consult with an attorney. The feds seemed surprised by my hesitation. What ensued was a flurry of legal proceedings that would last 38 days, ending not only my startup but also destroying, bit by bit, the very principle upon which I founded it that we all have a right to personal privacy. In the first two weeks, I was served legal papers a total of seven times and was in contact with the FBI every other day. (This was the period a prosecutor would later characterize as my "period of silence".) It took a week for me to identify an attorney who could adequately represent me, given the complex technological and legal issues involved and we were in contact for less than a day when agents served me with a summons ordering me to appear in a Virginia courtroom, over 1,000 miles from my home. Two days later, I was served the first subpoena for the encryption keys. With such short notice, my first attorney was unable to appear alongside me in court. Because the whole case was under seal, I couldn't even admit to anyone who wasn't an attorney that I needed a lawyer, let alone why. In the days before my appearance, I would spend hours repeating the facts of the case to a dozen attorneys, as I sought someone else that was qualified to represent me. I also discovered that as a third party in a federal criminal indictment, I had no right to counsel. After all, only my property was in jeopardy not my liberty. Finally, I was forced to choose between appearing alone or facing a bench warrant for my arrest. In Virginia, the government replaced its encryption key subpoena with a search warrant and a new court date. I retained a small, local law firm before I went back to my home state, which was then forced to assemble a legal strategy and file briefs in just a few short days. The court barred them from consulting outside experts about either the statutes or the technology involved in the case. The court didn't even deliver transcripts of my first appearance to my own lawyers for two months, and forced them to proceed without access to the information they needed. Then, a federal judge entered an order of contempt against me without even so much as a hearing. [snip]

3 3

scrypt and ASICs
by coderman 16 May '14

16 May '14

the other thread mentioned the "ASIC-able" ness of scrypt. what techniques may be used to make scrypt even harder to put on die? (is this an arms race between transistor count and algorithm tuneables?)

3 2

Observation re gmail/google cookies
by grarpamp 16 May '14

16 May '14

Is used to be such that only the mail.google.com:GX cookie was required to access webgmail (even if it added a number of other cookies post that access, they could be reasonably narrowed down and blocked to just mail.google.com, if I recall). Now within the past many months that has changed to include, at minimum, myriad cookies in google.com. (I've not tested which are the minimum set). These will potentially cross with ads and other tracking things. While great for google integration, it's bad for user privacy regarding domain/usage segregation. Do not trust the google in your browser anymore. As if, ever, obviously.

4 3

Re: "SIGINT tradecraftis very hands-on (li terally!)"
by John Young 15 May '14

15 May '14

There is a good chance the documents are covertly marked as you suggest, the ostentatious classification markings a ruse for untutored yokels to fancy are genuine. Covert markings have been in use for a long time, as well as ostentatious markings. On paper as well as digital and other forms of electronic. And certainly packets carry unique markings in a variety of overt and covert types. Some of the techniques fall under the inadvertent emanations rubric associated with Tempest -- which has blossomed well beyond the FOIA releases from the late 1990s. TSCM is a marvel of duplicity and ruse. At 08:16 PM 5/13/2014, you wrote: >From: Black Fox <fox(a)vbfox.net> >On Tue, May 13, 2014 at 2:58 PM, coderman ><<mailto:coderman@gmail.com>coderman(a)gmail.com> wrote: > > On Tue, May 13, 2014 at 1:00 AM, John Young > <<mailto:jya@pipeline.com>jya(a)pipeline.com> wrote: > >> > We've seen the Greenwald book No Place to Hide, where are the > >> > promised gush of Snowden documents available? His publisher > >> > doesn't show a source. Surely not another marketing tease. > >> great question; let us know if you find them! > ><http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.p > df>http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf > >If I were the telephone company from which the records were >requested, I'd note that the records were requested in "electronic" >format. Then, I'd ask a programmer to write a program to write a >program to generate pdf files with embedded "captcha"-type >text: Images that are quite apparent to the human eye, but are very >difficult for any computer to make any sense of. All the phone >records would be there (in no particular order), and they'd all be >very readable to humans, but... > Jim Bell >

3 2

Re: "SIGINT tradecraftis very hands-on (l i terally!)"
by John Young 14 May '14

14 May '14

That would be quite useful. How would you crack it if used by an opponent? At 01:11 AM 5/14/2014, you wrote: >Alright, what I meant was this: The judge ordered that the >information be provided in electronically-readable form. He meant, >"not on paper", because if it were on paper, that would be very >difficult to actually USE. My idea was to put the information onto >pdf files, where if you view the pdf file, it would look like lines >of "captcha"-type data: Weird, warped characters, in various odd >colors, overlapping lines, >etc. <http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, >the free encyclopedia Specifically designed to NOT be >computer-identifiable. The essence of the presentation of the data >would be that it wouldn't be readable by 'computer' at all; it would >have to be decoded by human intervention...even though it was in >"electronically-readable form"!! > ><http://en.wikipedia.org/wiki/Captcha> >image > ><http://en.wikipedia.org/wiki/Captcha>CAPTCHA - Wikipedia, the free >encyclopedia >A CAPTCHA (an acronym for "Completely Automated Public Turing test >to tell Computers and Humans Apart") is a type of challenge-respons... ><http://en.wikipedia.org/wiki/Captcha>View on en.wikipedia.org >Preview by Yahoo > Jim Bell

3 3

cypherpunks administrivia: no more reply-to header stripping
by Riad S. Wahby 14 May '14

14 May '14

Folks, Until now, mailman has been stripping Reply-To: headers from messages to the list. I've just turned this off. Some webmail services (notably, Yahoo!) set the Reply-To: header and include it in the headers signed with DKIM. Stripping Reply-To: thus breaks the DKIM signature. In the case of Yahoo! this signature breakage is especially problematic, because their DMARC policy is set to reject. (In other words, messages with yahoo.com in the From: header that fail both SPF and DKIM should be rejected by compliant mail services, e.g., AOL, Gmail, Hotmail, Yahoo!) Messages to the mailing list should pass SPF, since the envelope sender domain for list messages is cpunks.org and I publish an appropriate spf RR. However, any list subscriber who forwards mail to another account will have broken SPF and an invalid DKIM signature, which trips the DMARC policy and causes delivery failures. I realize that this might cause some inconvenience, but I would prefer to err on the side of successfully delivering messages whenever possible. If you're using procmail and prefer the old behavior, the following recipe should suffice: :0H * ^list-id.*cypherpunks.cpunks.org | formail -IReply-To -=rsw

1 0

Re: "SIGINT tradecraftis very hands-on (literally!)"
by John Young 14 May '14

14 May '14

We've seen the Greenwald book No Place to Hide, where are the promised gush of Snowden documents available? His publisher doesn't show a source. Surely not another marketing tease. Surely not snatched by the TLAs, tampered with, doctored, MTM'd, redacted, censored, cherry-picked, highlighted for dummies and fans, surely not handled like a disinfo spy op, heavy on narrative, suggestions of much more unreleasable, need for classified briefings and diligent vetting, that what we documents censors know we can't dare tell the public due to the public dupery by enemies of our interests. Dropboxes are honey pots, media is just that, governments are just that, opsec and comsec are just that. And do tell, what is this SIGINT forum psyoping? At 03:11 AM 5/13/2014, you wrote: >there's some new thing out, > > ... first shots from the peanut gallery? > >please report suspicious network behavior accessing Snowden documents >to the second hand exploit sale broker consortium for a reasonable >referral fee! > > >best regards,

6 5

Patented prime numbers
by Georgi Guninski 13 May '14

13 May '14

Probably this is well known. http://www.freepatentsonline.com/5373560.html http://mathworld.wolfram.com/PrimeNumber.html (check (3)) > Because of their importance in encryption algorithms such as RSA encryption, prime numbers can be important commercial commodities. In fact, R. Schlafly (1994) has obtained U.S. Patent 5373560 on the following two primes (expressed in hexadecimal notation): fuck, fuck, fuck.

6 10