- cypherpunks - lists.cpunks.org

a speech
by dan＠geer.org 14 Apr '14

14 Apr '14

Perhaps of relevance here. APT in a World of Rising Interdependence invited address, NSA, 26 March 2014 http://geer.tinho.net/geer.nsa.26iii14.txt --dan

3 3

Re: [cryptome] Re: snowman news
by John Young 13 Apr '14

13 Apr '14

Dear Maligned Ethicist Machet, Your fee for complaining about star *ucking has been transmitted to Hettinga's offshore dark pool of smegma. We appreciate your disclosing this private banking arrangement to encourage others to reap the benefits of advertising online the ancient love scribble scratched on rubber tree trunks, on kindergarten desktops, on unisex toilet stalls and distributed by porous-sheathed onion routers to mind*uck horny espionage pornsters posting and ogling kiddie-selfies for entrapment bonuses. Underarmored in *uck cpunks tees. @20Committee At 01:17 PM 4/13/2014, you wrote: >have not been more disappointed by star *ucking in i dont know when > >hardens my resolve to never align with any mother *ucker > >only align with ethics

4 4

Re: snowman news
by John Young 13 Apr '14

13 Apr '14

Great that Snowden is getting another chance to speak for himself, as available on an awfully restricted technical tube-like forum -- so far only talking head shots at the venues where he has been beamed in from who knows where, scripted by who knows who from his burgeoning team of handlers, now joined by EU polopportunists. It would be even greater if if Snowden himself released or at least displayed documents beside his head or encouraged the withholders to do so as the surcharge for their exclusive rigging of ever fewer releases. Head shotting and paneling by and about Snowden seems to have substituted for release of documents needed for us to reach our own conclusions. Entertainment over information. Oh well, that condescension is how media, politicians and governments manipulate us ignorant consumers of produce. Thanks for keeping us alert to EU produce. Regards, John At 07:22 PM 4/7/2014, you wrote: >http://www.dailytelegraph.com.au/news/breaking-news/snowden-to-address-europ >e-rights-watchdog/story-fni0xqlk-1226877345106 > >Snowden testifies: >Council of Europe Live video link: Tuesday, 12 noon GMT: >http://webtv.coe.int/index.php?CategoryID=56763&SubCategoryID=56776 >Link will be active 30 minutes before event.

4 4

Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL
by grarpamp 13 Apr '14

13 Apr '14

On Wed, Apr 9, 2014 at 2:29 PM, Christopher J. Walters <cwal989(a)comcast.net> > > It makes me wonder if the NSA was involved in inserting this bug into > OpenSSL clients and servers. That would be 2+ years of amazing win on NSA part [1]. Any unlikely impropriety would come out soon. More likely reality... opensource people are busy and good humans and coding mistakes happen. Hopefully the general buzz around NSA/security/crypto/decentral will result dedicating more permanent resource to things like protocol devel and replacements, and auditing of key underlying software code. You really need to be asking if and how the giant for-profit corps that use opensource for free are giving back. $50k a year donated to fund an independant developer pool from the OSS community to sit on the teams of your favorite code projects of choice as auditors is nothing to a companies like that, a dream gig for the dev, a win for project, and good company PR. How often do you see @ge.com @chase.com @ibm.com, etc on developer/donation lists... you need to ask those type of @'s if, how, and why not. [1] And pretty dumb of any attacker to not simply quietly watch, analyse and exploit the committed output of any critical project... no insertion, cost, or risk necessary to do that.

12 29

Re: [cryptome] Re: snowman news
by John Young 13 Apr '14

13 Apr '14

The Polk Award plaques have concealed cavity transmitters, so our Google glasses indicate. Back-up. we palmed a sliver RFID in GG's wide mouthed molar, another in Miranda's steely butt, Poitras's panoptic camera, Gellman's top-sekret OTR widget, MacAskill's brogue-decrytor (we saw him plant a 0-day craw deep inside James Ball's kisser). Our totally undoctored vids and transcripts are at Amazon, Utah, Four Eyes, RU, CN, BR, all of them on the same transceiving thieving pipe, each with a twinned JPmorgan, Goldman Sachs fiber, so reports ourr splitter at Ross Anderson's lab in Oxbridge-Cheltenham, centroid of the universe's gobbling inadvertencies. The fake one underskinned in Markus Kuhn's vestigal tail. Real one infected at Vatican, eternal cloud of the pipe of pipes. ----- On Mon, Apr 7, 2014 at 4:48 PM, John Young <jya(a)pipeline.com> wrote: > Great that Snowden is getting another chance to speak for himself, speaking of speaking directly, i hear one fine JYA got to mingle with the leakers? how hard did you press for a mass doc drop, John? i would have donated toward such a bribe... looks like an interesting crowd! (who has .vid transcripts?) best regards, #JustALittleJealous c.f.: http://cryptome.org/greenwald-miranda-young.jpg

1 0

"How I obtained the private key for www.cloudflarechallenge.com"
by rysiek 13 Apr '14

13 Apr '14

Hi there, https://gist.github.com/epixoip/10570627 -- Pozdr rysiek

3 3

NTRU Prime implementation
by coderman 13 Apr '14

13 Apr '14

reification requested! http://blog.cr.yp.to/20140213-ideal.html """ Here's a concrete suggestion, which I'll call NTRU Prime, for eliminating the structures that I find worrisome in existing ideal-lattice-based encryption systems. This suggestion uses a number field of prime degree, so that the only subfield is Q; and uses an irreducible polynomial xp-x-1 with a very large Galois group, so that the number field is very far from having automorphisms. The best CVP dimension seems to be about half the degree; this is optimal for number fields without many real embeddings. (It's hard to create many real embeddings while keeping coefficients small, and if coefficients are large then there are other problems.) This suggestion also chooses its modulus q so that (Z/q)[x]/(xp-x-1) is a field; this simultaneously avoids (1) NTRU's traditional 2-adic structure and (2) the linear splittings used in most recent papers. """

1 0

NSA alleged to have known & used Heartbleed for 2 years
by Gregory Foster 13 Apr '14

13 Apr '14

Bloomberg (Apr 11) - "NSA Said to Have Used Heartbleed Bug, Exposing Consumers": http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-b… > The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said. gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

3 4

If not StartSSL, the next best CA for individuals?
by Eric Mill 12 Apr '14

12 Apr '14

(Setting aside how awful the CA system is generally...) For those who still have a need to participate in it, and for those angry at StartCom's refusal to waive[1][2] revocation fees for their free class 1 certs, what's the best CA for the job? Even if not free, I'm looking to recommend[3] something priced attractively for individuals and non-commercial uses. The friendlier the interface, and the more reliable and principled the customer service, the better. -- Eric [1] https://cv.exbit.io/emails/startssl_heartbeat.txt [2] https://twitter.com/startssl/status/453631038883758080 [3] https://konklone.com/post/switch-to-https-now-for-free -- konklone.com | @konklone

2 1

healthcare.gov vulnerability?
by jim bell 11 Apr '14

11 Apr '14

It occurred to me that I haven't heard much on the news about deliberate attacks on the healthcare.gov website, even though it is reputed to be extremely weak. Might somebody (potentially a supporter of Obama and/or Obamacare) have deliberately 'spammed' it with fake signups, simply to get the number of such signups increased? How vulnerable would it be to 'invented' names/addresses? How 'valid' would these names/addresses have to be to keep the system from finding out until some arbitrary stage in the process? If such an attack had been done, would the public ever find out, and when? Jim Bell

5 6