- cypherpunks - lists.cpunks.org

Re: [Cryptography] Inevitable Security Critiques, Promises and Lemons
by Robert Hettinga 20 Apr '14

20 Apr '14

On Apr 19, 2014, at 10:07 AM, John Young <jya(a)pipeline.com> wrote: > Still hopeful Hettinga will plug these insider breaches of why marketing > lemonade is so lucratively persuasive to those who know better. And who > do not disclose here. I’ll endeavour to persevere… Cheers, RAH

1 0

Inevitable Security Critiques, Promises and Lemons
by John Young 19 Apr '14

19 Apr '14

Gratifying to see a few of those here featured in NY Times today discussing inevitable failures and contradictions in security: http://www.nytimes.com/2014/04/19/technology/heartbleed-highlights-a-contra… To be read with Schneier's 2007 account of inevitable security lemons (resurrected by Coderman): https://www.schneier.com/blog/archives/2007/04/a_security_mark.html Our security consumer advice based on frank, honest and distrustful discussions here for nearly 18 years: "Unreliable SSL has been uninstalled. All security and privacy policies are unreliable. Protect yourself against security and privacy promise." Still hopeful Hettinga will plug these insider breaches of why marketing lemonade is so lucratively persuasive to those who know better. And who do not disclose here.

1 0

Lavabit
by dan＠geer.org 18 Apr '14

18 Apr '14

http://www.techweekeurope.co.uk/news/lavabit-snowden-appeal-lost-144112 Lavabit Loses Contempt Of Court Appeal Failure to hand over encryption keys could land Lavabit founder Levison with hefty fines On April 17, 2014 by Thomas Brewster Lavabit, the email service once used by whistleblower Edward Snowden, has lost an appeal against a contempt of court ruling that he delayed the US Government's attempts to gather information by refusing to hand over encryption keys. the email service, which has since closed, was eventually forced to comply anyway. The US government asked for SSL keys to look at the metadata (dates and other details of communications) for a specific Lavabit user, believed to be Snowden, The service's founder Ladar Levison at first refused, and when forced to comply, provided the keys printed in a tiny typeface. The court ruled that Lavabit had not followed correct procedures in its initial hearings, and had not raised a specific challenge to the district court's authority under the so-called "pen/trap statute". Levinson could now be fined for contempt. "Levison's statement to the district court simply reflected his personal angst over complying with the pen/trap order, not his present appellate argument that questions whether the district court possessed the authority to act at all," read a statement from the fourth US circuit court of appeals Judge G Steven Agee. "Arguments raised in a trial court must be specific and in line with those raised on appeal." The case stems back to June last year, when the US government sought to acquire private keys for SSL encrypted traffic of a specific Lavabit user, thought to be Snowden. Officials sought to put a tap on the communications of that target to collect metadata. Levison, when approached by FBI officials, refused to hand over the keys, which eventually led to the contempt of court charge. According to the court filing denying his appeal, Levison suggested he could provide the content the government was after, rather than using their interception tools. The government decline the offer, saying it needed real-time acquisition of the target's data. A device to intercept traffic was installed as part of the pen/trap order, but could not gather usable information as the encryption keys had not been provided. Officials did eventually get the keys in August 2013, however. "The government sought penalties of $5,000 a day until Lavabit provided the encryption keys to the government. The district court granted the motion for sanctions that day. Two days later, Levison provided the keys to the government. By that time, six weeks of data regarding the target had been lost," the court ruling read. Levison could now be fined thousands of dollars.

2 1

Re: SMTP is bad, guys (and gals, and other spectrum earth humans)
by coderman 18 Apr '14

18 Apr '14

On Wed, Apr 16, 2014 at 6:29 AM, Georgi Guninski <guninski(a)guninski.com> wrote: > On Wed, Apr 16, 2014 at 04:55:27AM -0700, coderman wrote: >> >> and private >> industry privacy invasion, as they're both faces of unrestrained > > weird to write this from gmail account :) nothing conveys my contempt for email like gmail! *grin*

1 0

Why didn't Snowden disclose Heartbleed (and others)?
by Lodewijk andré de la porte 16 Apr '14

16 Apr '14

Exhaustive list of possibilities (please extend where possible): A Did not know B Did not care C Felt like it would negatively impact the NSA's (legitimate) functioning D Didn't get around to it yet E Snowden is an unconventional NSA set up F Snowden's documents are not recent enough A, is interesting, as it would show that the NSA has levels of secrecy and secret data that go further than what they had so far. Something above "TOP SECRET" should probably exist, and Snowden didn't find it. This actually makes a lot of sense to me, so it might well be it. B, he might think it's not very interesting. Using 0-days should be old-hat and expected. Disclosing specific exploits would not stop the bleeding, the NSA would just find new ones. He might even consider 0-day hoarding acceptable business, just not the mass employment of them. C, he's often maintained a sort of "I'm coming out to the public with this, but I'm very sorry to hurt the US in a way"- kind of attitude. It would definitely cripple the NSA if he released novel and important bugs. Think of how hard it would be to hack-back at China! D, There's some scheduling going on to maximize impact. He might release the "0-day-exploit list that endangers live as we know it, and the NSA did nothing" later, when attention dies down again. E, Maybe the NSA have become a common thing in popular culture and they dislike their image of being a completely opaque organization with potentially unlimited power. So now they are sharing information about the "outer shell" of the organization, a sort of facade. Meanwhile it seems like the world is crushing down upon them. In a few years their image will be renewed. Everyone will think "The NSA was not that unlimited in it's capabilities and worked very hard. Now that they have rules and limits it will all be okay". And with that a whole new level of FUD will have been achieved. Making people believe they are the evil you know. Of course, this is religious level conspiracies. And of course, that's exactly the level the NSA would start to accept. They're the information and espionage experts. If anyone could pull this off, it'd be them. (Didn't the CIA/NSA own the media? Don't they still? This might be easier than you'd expect) F, I couldn't find exactly to which date his documents go. Heartbleed was merged December 31 2011 (lonely night? sneaky vacation timing?). Assuming the NSA checks patches (ofc they do) they should've found it in Jan 2012. Snowden. Ah. Found it. "reenwald began working with Snowden in either February[113] or in April after Poitras asked Greenwald to meet her in New York City, at which point Snowden began providing documents to them both" That'd be April 2013. He still might've stolen the documents earlier, but who knows?

5 6

Fw: Why didn't Snowden disclose Heartbleed (and others)?
by jim bell 15 Apr '14

15 Apr '14

From:jim bell <jamesdbell9(a)yahoo.com> From:Lodewijk andré de la porte <l(a)odewijk.nl> 2014-04-15 21:11 GMT+02:00 Cypher <cypher(a)cpunk.us>: This is why I've long been an advocate of total disclosure. I think >the document holders should publish everything they have. After they >do that, they could continue to 'leak release' documents with detailed >explanations for those who are too lazy or too confused by the >documents to sift through them and read them but having a document >dump out there would make the process of disclosure /much/ faster. >The problem is that the general public is very slow to learn. Every step along the way even the wise said things >like "OH! The NSA said A, but they'll never say B!". Then two weeks later the docs show that B has not just >been said, it'd been SCREAMED. Then the word is "But they'll never say C!". Etc. Maybe at some point >people will pick it up differently. >It also fits the media format better to drip info. A new news article every new drip. That makes for a lot more >exposure. If they are going to 'drip, drip, drip' it, they should release it all first in hashed form, so that: 1. We ultimately know we get it all. 2. We know it hasn't been modified from the form it was originally in. Jim Bell

1 0

Obama allows NSA to exploit 0-days: report
by Georgi Guninski 15 Apr '14

15 Apr '14

http://www.theregister.co.uk/2014/04/14/obama_allows_nsa_to_exploit_0days_r… Obama allows NSA to exploit 0-days: report ==== President Obama considered what the NSA should do if it becomes aware of a vulnerability that could help its activities. His decision led to the creation of “... a broad exception for 'a clear national security or law enforcement need'.” ==== m$ gives the nsa steady amount of their 0days (admitted), not counting the backdoors.

4 3

White House, spy agencies deny NSA exploited 'Heartbleed' bug
by jim bell 15 Apr '14

15 Apr '14

White House, spy agencies deny NSA exploited 'Heartbleed' bug photoSecurity experts warn there is little Internet users can do to protect themselve\WASHINGTON (Reuters) - The White House and U.S. intelligence agencies said on Friday neither the National Security Agency nor any other part of the government were aware before this month of the "Heartbleed" bug, denying a report that the spy agency exploited the glitch in widely used Web encryption technology to gather intelligence. The White House, the NSA and the Office of the Director of National Intelligence issued statements after Bloomberg reported that the NSA was aware of the bug for at least two years and exploited it in order to obtain passwords and other basic information used in hacking operations. The Bloomberg report cited two unnamed sources it said were familiar with the matter. The Heartbleed bug is considered one of the most serious Internet security flaws to be uncovered in recent years. "Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong," White House National Security Council spokeswoman Caitlin Hayden said in a statement. "This administration takes seriously its responsibility to help maintain an open, interoperable, secure and reliable Internet," Hayden added. Bloomberg was not immediately available to comment. The discovery of Heartbleed by researchers with Google Inc and a small security firm, Codenomicon, prompted the U.S. Homeland Security Department to advise businesses on Tuesday to review their servers to see if they were using vulnerable versions of widely used software known as OpenSSL. OpenSSL is used to encrypt email and other communications and to protect the websites of big Internet companies, including Facebook Inc, Google Inc and Yahoo Inc. The bug, disclosed Monday, allows hackers to steal data without a trace. NSA spokeswoman Vanee Vines said in a separate statement: "NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report." Hayden said the federal government relies on OpenSSL to protect the privacy of users of government websites and other online services. "If the federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL," Hayden added. Hayden said that when U.S. agencies discover a new vulnerability in commercial and open-source software, "it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose." Such vulnerabilities are known as "zero-day" flaws because the software developers have had zero days to fix them. In December, a five-member advisory panel convened to review electronic surveillance policy urged the White House to sharply curtail the use of undisclosed flaws and stop undercutting encryption standards. The panel included former White House cybersecurity advisor Richard Clarke. In late February, a senior White House official said the Obama administration was intensively studying both issues. The administration statements issued on Friday confirmed that the review had already "reinvigorated an interagency process for deciding when to share vulnerabilities" on a case-by-case basis. The activities of the NSA have come under sharp scrutiny since former agency contractor Edward Snowden leaked numerous documents exposing expansive U.S. surveillance efforts. Even before Snowden's emergence, former officials, including Clarke, told Reuters that offensive and spying considerations had dominated inside the NSA, causing it to withhold information instead of warning the public about new flaws. Clarke told Reuters Friday that the NSA had not known of Heartbleed. The U.S. government warned banks and other businesses on Friday to be on alert for hackers seeking to steal data exposed by the bug, as a German programmer who volunteered with OpenSSL took responsibility for inadvertently launching the security crisis. (Additional reporting by Joseph Menn; Editing by Jonathan Oatis)

6 6

Home-made communications and security technology
by John Preston 15 Apr '14

15 Apr '14

Given the enormous complexity of modern technology (100+ KLOC software projects, 1+ billion transistor CPUs, etc.) I view security failures to be an inevitability: the attack surface is rich for exploitation by enemies, and bugs and errors constantly emerge due to both man and machine. That said, I do not think it unwise to consider it a prerequisite for the most paranoid-level technologies that they be easily understandable and scrutinisable by individual people. Hence, I have an interest in pen-and-paper ciphers, simple wireless communications systems for Morse, voice, and data, and simple computers. Is this something other people think is a sensible or important line of inquiry? Do these technologies and the people using them exist? Are there movements advocating this approach? Thank you.

2 1

a speech
by dan＠geer.org 14 Apr '14

14 Apr '14

Perhaps of relevance here. APT in a World of Rising Interdependence invited address, NSA, 26 March 2014 http://geer.tinho.net/geer.nsa.26iii14.txt --dan

3 3