- cypherpunks - lists.cpunks.org

To Tor or not to Tor?
by rysiek 27 Mar '14

27 Mar '14

Hi there, As I am running a local cryptoparty and do a lot of basic encryption/privacy talks and workshops, I am often recommending Tor as one of the means of protecting one's privacy and yes, even security (for example, by running a hidden service and making it possible for users not to leave the darknet). Of course it's far from being enough, and I make that very clear. But lately I got to wonder if using Tor does more harm than good? If the NSA can impersonate any IP on the planet, they can impersonate any Tor node; tis has two important consequences: 1. they know when you're using Tor, and can flag you accordingly, and (for example) deliver some nastiness when (not "if"!) they get the chance, because "when you have something to hide..." 2. they can guess with high probability whom are you communicating with; they don't have to break encryption, it's enough they listen-in and see that a Tor packet from your IP to Node A is x bytes; a packet from Node A to Node B is x-( header + Tor encryption layer size ) bytes, and so on. So, is using Tor today doing more harm than good? Would ordinary Joe Schmoes be far better of not using Tor? How about more high-profile targets, like activists/hacktivists, etc? -- Pozdr rysiek

10 18

The National Security Agency at the Crossroads (Austin: Apr 3-4)
by Gregory Foster 27 Mar '14

27 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 The National Security Agency at the Crossroads (Austin: Apr 3-4) https://strausscenter.org/details/279-privacy-surveillance-and-the-nsa.html If you review the agenda and speaker list, you'll see this event is a pretty big deal. > The Intelligence Studies Project is a joint venture of the Strauss > Center and Clements Center at the University of Texas at Austin, > aiming to encourage policy-relevant academic inquiry into the past, > present, and future of intelligence agencies and the legal, policy, > and technological environments in which they operate. Nothing > better illustrates the need for such inquiry than the events of the > past year surrounding the National Security Agency. As part of a > larger effort to improve public understanding of those events, the > Robert S. Strauss Center for International Security and Law and the > William P. Clements Jr. Center for History, Strategy & Statecraft > are hosting a major interdisciplinary conference focused on the NSA > from April 3rd through 4th. It will cover topics including the > history of the NSA, the role of the media in revealing classified > information about its activities, the legal architecture in which > it operates, the compliance and oversight mechanisms associated > with the NSA, the diplomatic fallout from the recent revelations, > and the prospects for reform. Although open to the public, the event is already waitlisted. I'm aware of at least a few concerned citizens who signed up to attend and plan to document the event through various channels. http://www.eventbrite.com/e/privacy-surveillance-and-the-nsa-tickets-895383… If you have an interest in this event you'd like to discuss, please contact me off list. gf - -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJTM62eAAoJEMaAACmjGtgj8NsP/AxHR2VOTHivwqv7MmnkZ9kS l+kFi9RC9ZB0e80jAljc32FnIRWhhmry1/BOU9dgtWEzmcpfInAQdTHV01droXT1 XlxiEvVfv5Sh7Ln3gE4nv2UgUFTy8GXZAmRoVilr/SCietQd5nOFoWhzLPEsnfGw PYAUE5FHu4Sh2tEcCJDSGPZOe/Rd7QvlU4qd3drTOwnC840X5x0CtylGXVWHxMcl K/nAzuMkhB+Zd3tErka2yR7vw42Ch5PeT6qN3c5TtLywhAVSamqQjzWfeJdx6NMk /F89Q8oJcJ1zLfpePhuj+m4FRCTq3/ONmk+d4NpwRAP5v+BeXk4EyHadibf5GJX2 7IUlR77p1cTi//QvwvkQq0iBnESBDRu+JaUI8fX2bluuIK9PZnS/AJG4A8KE9ujo wciHmFk0uAuxw5GqHNF0VLo8JQjc2DDNcmsHheVXuzE9txMShdgonWPoxVfouXys JetLGAZwFhbxfku5bXpqVYnNLQi5FfMaIEZ6saT8cEWdbuCpbuXKSAsEMSY/LIjK DaITHHO+YiRD7qlM/TakpI934F925k4pQ3rA3Y32ObihacjQHysN2LkOhUPuITY7 RLbUCbww1Dcb0QGUgib7INSRTWnN+vt+fsN07jgTtXr60VfXdGF3pUHAxqZ9d/nX esziR2DQx3s7u+15clcf =Wdx1 -----END PGP SIGNATURE-----

1 0

"Whew, wondered where we'd put those 200,000 BTC!"
by jim bell 25 Mar '14

25 Mar '14

http://www.engadget.com/2014/03/20/mt-gox-apparently-found-200-000-bitcoin-… "In a bit of news that's familiar to anyone who ever put on an old jacket and found $20 in the pocket, embattled Bitcoin exchange Mt. Gox has made a fortuitous discovery. The company announced (PDF) in Japan that it found 200,000 Bitcoin (worth nearly $116 million at the moment) in a wallet from 2011 that it no longer used. That's less than a quarter of the 850,000 Bitcoins CEO Mark Karpeles reported were missing, but at the moment, at least it's something. According to its statement, the coins were moved to online wallets on the 7th, and then to offline wallets on the 14th and 15th. The mystery of what happened to Mt. Gox's funds is still far from solved, but between this news and reports of updated balances for account holders, it seems possible that there's something to be recovered from the shuttered exchange. Next up, removing all of the cushions from the sofa and pulling it away from the wall."

13 39

Documentary to be filmed on the life of the last original Navajo Code Talkers, Chester Nez
by William Knowles 24 Mar '14

24 Mar '14

http://www.infosecnews.org/documentary-to-be-filmed-on-the-life-of-the-last… By William Knowles Senior Editor InfoSec News March 24, 2013 Chester Nez, the last surviving member of the original 29 Navajo Code Talkers, will be the subject of filmmaker David DeJonge's upcoming 30-minute documentary. "Chester is the last link from the Navajo people who forged a secret code that helped win the Second World War. Their code led to the training of 400+ additional Navajo code talkers. To record his story in first hand is critical to American and military history." DeJonge said. DeJonge who is well known for his work with the last WWI veteran Frank Buckles, and also his documentary "Pershing's Last Patriot", began producing the documentary on Nez after a visit to Gallup, New Mexico. Nez served with the United States Marines in the Pacific and helped defeat the Japanese by creating a code, using the Navajo language, that was never broken. Sent to a boarding school as a child, Nez and other Navajo children were discouraged from speaking their native language and instructed to only use English, but that didn't stop them from whispering Navajo to each other in secret. In 1942, Navajo were recruited from boarding schools to join the Marines and use their unique skills to develop an unbreakable code to pass messages. The film will tell Nez's story from childhood through today. [...] -- GPG key on request http://www.c4i.org/erehwon/

1 0

citizen privacy groups?
by Blibbet 23 Mar '14

23 Mar '14

Hi, We're trying to build a list of contacts to (city,county,state,county)-based privacy groups, to see if a multi-city coalition would be helpful. We have private contacts that we're hoping to shortly have a mailing list setup, so they can communicate better. Below is current list I'm aware of. There's many cities that I can't find groups for; are things really that bad? :-( If you have a contact at one of these groups, please contact me off-list! Thanks! Lee ---------- Seattle Privacy https://www.seattleprivacy.org/ Oakland Privacy http://oaklandwiki.org/Oakland_Privacy_Working_Group Los Angeles: Stop LAPD Spying Coalition http://stoplapdspying.org/ Oregon: https://twitter.com/OregonPrivacy Austin, Texas: EFF Austin http://effaustin.org/about/ http://twitter.com/EFFaustin https://www.facebook.com/eff.austin Texas: Texas Electronic Privacy Coalition http://txepc.org/ Texas: Restore the Fourth ATX https://twitter.com/Restore4thATX http://restorethe4th.com/ https://www.facebook.com/RestoreThe4thAustin New York:The Calyx Institute https://calyxinstitute.org/ Germany: list of local AK Vorrat (German Working Group on Data Retention) groups https://wiki.vorratsdatenspeicherung.de/Ortsgruppen Cologne, Germany: http://cologne.stopwatchingus.info/demo-12-april/en.html ----------

2 2

this looks like a fun conference
by Cari Machet 23 Mar '14

23 Mar '14

*The Expo* The exposition will be unclassified and will consist of a two day event as an adjunct to the SIGINT Conference. The conference sessions will be conducted in a classified area in close proximity to the exhibits. *The Conference* This classified conference will focus on the preeminent intelligence issues facing those who are tasked with SIGINT as part of their mission. Over 1500 participants from the US intelligence community and throughout the world will attend this conference. https://www.fbcinc.com/event.aspx/Q6UJ9A00YDM3 -- Cari Machet NYC 646-436-7795 carimachet(a)gmail.com AIM carismachet Syria +963-099 277 3243 Amman +962 077 636 9407 Berlin +49 152 11779219 Reykjavik +354 894 8650 Twitter: @carimachet <https://twitter.com/carimachet> 7035 690E 5E47 41D4 B0E5 B3D1 AF90 49D6 BE09 2187 Ruh-roh, this is now necessary: This email is intended only for the addressee(s) and may contain confidential information. If you are not the intended recipient, you are hereby notified that any use of this information, dissemination, distribution, or copying of this email without permission is strictly prohibited.

2 2

Re: "Whew, wondered where we'd put those 200,000 BTC!"
by tpb-crypto＠laposte.net 23 Mar '14

23 Mar '14

> Message du 23/03/14 04:45 > De : dan(a)geer.org > A : cypherpunks(a)cpunks.org > Copie à : > Objet : Re: "Whew, wondered where we'd put those 200,000 BTC!" > > > It were write that: > > > You are in the same boat of Karpeles and Ulbricht, they also were > > barely able to code some interpreted language and they were overwhelmed > > by the intricacies of the systems they were building. Until they > > finally brought disaster for themselves and everyone that depended > > on them. > > True but inevitable. Humans can design systems more complex than > they can then operate. The financial sector's "flash crashes" are > one, but only one, public proof-by-demonstration of that fact. I > predict that the fifty interlocked insurance exchanges for Obamacare > will be another. It is likely that any cryptocurrency exchange > that is center-free and self-mobile is harder still. The HTTP > Archive says that the average web page now makes out-references to > 16 different domains as well as making 17 Javascript requests per > page, and the Javascript byte count is five times the HTML byte > count. > > Above some threshold of system complexity, it is no longer possible > to test, it is only possible to react to emergent behavior. Even > the lowliest Internet user is involved -- on the top level page for > a major news site, I found 400 out-references to 85 unique domains > each of which is similarly constructed. If you leave those pages > up, then because most such pages have an auto-refresh, moving your > ass to a new subnet signals to every single advertising network > that you have done so. > > --dan > Your comments naturally lead us to think how to make simple systems, yet functional enough for the purpose we are building them. KISS is coming back into vogue. We are up to a revival in self-made purpose-specific web servers. Learning the few needed protocols and building from the ground up using open-source tools seems the way to go. Notwithstanding hardware issues, using things out of intel and amd seems also to become a trend.

1 0

Re: secure anonymous decentralized systems [was: "Whew, wondered where we'd put those 200,000 BTC!"]
by coderman 23 Mar '14

23 Mar '14

this thread needs more violin and cutting one's self. my comments on this familiar lament inline,... On Sat, Mar 22, 2014 at 6:14 PM, Lodewijk andré de la porte <l(a)odewijk.nl> wrote: > ... > The sad part is that I got scared away from [storing value on-line] ... > > I spent days feeling sick because I couldn't figure out a way to do > exchanges distributed over sufficiently geographically disperse points to > avoid trouble with a single government going mad. Then I realized the > Megaupload situation means that any US-ally country is susceptible to a > planned US-exercise. > > Once I found that I cannot trust maybe 150 countries in the world with the > rest being mostly unsuitable, that turned into a bit of a problem... > > Then you realize you're still not physically secure. The server itself is a > hotbox of 100% exposure... > > If you let the box call homes first (homes is the list of other servers) it > can use it's already present crypto to prevent any possible MITM or > listening in. So that's good. Problem is a little liquid nitrogen, > connection on a bus or firewire port, etc. is enough to make the server > bleed information faster than the Titanic ate water. So you have to cut the > firefire connections (USB is okay and convenient AFAIC) and heat-conductive > epoxy the motherboard, RAM and a good margin around the CPU too (use a > taller and wider cooler than usual). Maybe even run some wires through it to > measure breach. > > Then you find out Intel's chips have all sorts of hyperintelligence on it to > allow "remote administration" which just blew my fucking mind halfway across > the galaxy. [ED:. yes, it really is this bad!] > > Once you have your physical platform you have to make sure the software is > okay. I found that it's entirely impossible to not trust your compiler. And > the likelihood of cutting yourself is way too high with low level languages. > ... But you have to, because you can't do better. ... > > By now I'm a week further in worrying and researching, I'm sweating more at > night, I don't feel comfortable using my own computer anymore, I don't > understand why the world isn't a chaotic place where no computer ever is not > hacked out of it's guts. I realize it's probably because nobody is motivated > and smart enough to go through the effort, and then also doesn't get caught > except for those that'd pay a high price to hide their capabilities, which > is why you'd never notice. it's like a pair of glasses you put on, and can't take off! " i see vulns, everywhere! " ;P > Knowing all this I quite damn well decided I couldn't make a secure and > reliable centralized exchange. No distributed exchange would earn me a > profit, which I'd need to produce more software to help other people's life > better, so that wouldn't really help either. Aside from the fact that it > would not be popular because it'd be slower and less easy than a "central" > exchange. see also stealthy dopant level trojans, beam-steering TEMPEST, and you've seen much the same as i on my excursion down what it takes to build "secure anonymous decentralized systems". ( decentralized meaning that every node potentially equal, which means that every threat model a node might experience must be defended, which means you're building to the absolute hardest target, which means you've adopted multiple nation state attackers into scope, which means you're building something entirely unlike what we currently have or know how to build, and absolutely a long way from here...) wanna help? just working on the pieces is useful! [see also, not getting discouraged and giving up. *grin*] > Overall I decided I respect greatly the people that take on this challenge. > This was over a year ago. have you gone through the NSA TAO and SSO catalog? this is a great resource for putting some technical capability around the threat models above, and building test systems able to carry out attacks like those above. (for testing. in a test environment. of course :) > Looking at the hacks that happen I'm mostly shocked to find the level of > stupidity. Shocked as much to see how long things just go on without > significant trouble. and you wonder why USGov is trying to beat miscreants into submission with CFAA life destruction. everyone is passing the security buck, DA gotta do something... [this is just one of many poor trends.] > MtGox failing because money dissapeared over the > years... That was shocking at an unbelievable level. you must be new to interwebs? see also, every blackhat doxing crew since ever. > ... The list goes on. see also, every blackhat doxing crew since ever. > So I think I'm capable of making an exchange platform that's far better than > what's out there right now. And I will once I have time (I really don't have > it right now, life is such a fuzz). > > I still question if it'd be used by anyone. But at least I can try. don't do it. instead, build software secure and usable enough that every average user can be their own exchange and bank without falling prey to haxxors or stupidity. oh, someone told me that i'm depressing the hackers with my realism and please try to make the self hurt less desirable, so here, my real world cover is goat farmer: https://peertech.org/files/totes-coders-goats.jpg </shameless_plagiarism> [ i hope that didn't reduce my anonymity set too much! ]

2 1

Fwd: [RNG] Haveged - A Simple Entropy Daemon
by coderman 23 Mar '14

23 Mar '14

fwd, and added comment at end about a "upstream distribution" of repute. ---------- Forwarded message ---------- From: coderman <coderman(a)gmail.com> Date: Sat, Mar 22, 2014 at 6:06 PM Subject: Re: [RNG] Haveged - A Simple Entropy Daemon To: Brad Martin <yabrad(a)gmail.com> On Sat, Mar 22, 2014 at 5:44 PM, Brad Martin <yabrad(a)gmail.com> wrote: > ... > When great HWRNG is working, it can be damned difficult to find the > signatures - but they're always there. Even in the best case, cryptographers > must whiten, if only to scramble those signatures. But the magic is in that > underlying raw data - so unpredictable! this too, a much longer discussion. we are in agreement, though one point: when FreeBSD decided against direct use of _both_ RDRAND and XSTORE, it was not an equal dismissal. RDRAND is specifically, and intentionally designed without direct access to the physical entropy sources, while XSTORE allows direct access to a userspace entropy daemon through the MSR configuration bits. XSTORE in raw mode, to userspace entropy daemon (rngd) that continously monitors for catastrophic failure (as above), and then _conservatively_ digests and folds the entropy before adding to OS kernel entropy pool is a robust configuration. RDRAND and RDSEED inherently crippled - if you had to pick a design, you would pick raw access with open and independent validation of run-time behavior with configurable conservative'ness as you so chose. instead, NIST and FIPS push _hard_ on opaque designs without raw access. in turn, US Gov pushes vendors hard for NIST/FIPS compliance. this is just one stream of influence working against the interest of users and strong privacy. if you really want to do entropy without repute: 1.: it starts with development and distribution, where every host and runtime is seeded with distinct mastering entropy that is mixed on first boot.** 2.: every physical host contains two (redundant) physical entropy sources run in continuous verification with immediate halt/panic on dual physical source failure. 3.: opportunistic entropy gathering daemons also running on host including haveged, dakarand, and kernel interrupt and activity scavenging. 4.: virtio-random device support feed into guest OSes from host entropy pool. (Qemu, KVM, Vbox, etc.) 5.: at shutdown of physical host entropy state is saved to FDE protected root volume for re-incorporation into entropy state on next start. 6.: as signal of care, in all mastering images and runtime ensure that /dev/urandom links to /dev/random special device. 7.: use the strace to confirm in every application that appropriate entropy from /dev/*random is read when generating keys or nonces. [post to HN when confused about key length equivalences and application level entropy pools...] ** your distribution in turn is fully reproducible, and the builder of your images provides you an installation image signed by them, including all the other public sigs, and including the per-instance entropy, the entirety of which is then also signed again. you exchanged keys in person at some point in the past, to get your first copy of $secure_distro, and have been using meatspace authenticated keys ever since...

1 0

fractional reserves (was Re: Gox)
by dan＠geer.org 22 Mar '14

22 Mar '14

It was quoted: > "Injections in coin are most useful (enough to run the exchange) but > some cash is also needed to not run a fractional reserve" Those who find BitCoin interesting and wish it was more like world class banking will perhaps also be interested in this (de-html-ized) description of what that means: 21stcenturywire.com/2014/03/21/the-latest-heist-us-quietly-snatches-the-ukr… The Latest Heist: US Quietly Snatches the Ukraine's Gold Reserves March 21, 2014 As the dust settles in Kiev, another money trail has been revealed... According to reports out of Kiev (see links below), the US has quietly transfers 33 tons of Ukrainian gold out of the country and back to vaults in the US. Presumably, this sovereign wealth transfer would be counted as partial "collateral" for a fresh round of IMF, US FED, and ECB paper debt that is currently being organised for dumping into the Ukraine's economic black hole. Multiple inquiries to US Federal Reserve administrators into the location of the Ukraine's gold have been met with the proverbial `pass the buck', making tracking and tracking the final resting place of these 33 tonnes very difficult indeed - but one can expect that the NY Fed is probably the institution who has masterminded this financial heist. Note how gold flows into New York, but has difficulty flowing out of US private banking hands as is the case with the `confiscation' of Germany's gold. Numerous attempts by Bundesbank to repatriate its gold reserves have been met with a brick wall, and to date, Germany has only recovered a miniscule 5 tonnes directly from the NY Fed - out of the total 674 tonnes (an additional 32 tonnes were recovered via French central bank). It's worth pointing out here that when NATO sacked Libya in 2011, one of the first items that came into question was the gold in Libya's state-run central bank. Prior to the NATO takeover of that country, Libya had one of the highest per capita gold reserves in the world, alongside Lebanon, giving Libya a distinct advantage should it carry out former Libyan leader Muammar Muhammad al-Gaddafi's long-term financial transition to a gold-backed Libyan Dinar. As you can imagine, this is no longer the case in Tripoli. Additionally, like Libya, both Syria and Iran are two of the world's last remaining nation states who both have state-run central banks and gold reserves which fall outside of the world's private central banking syndicate. Needless to say, you can see an obvious pattern emerging here. And the story continues... The Big Lie + What Happened To Ukraine's Gold? By PM Fund Manager Dave Kranzler Investment Research Dynamics The Big Lie is that Central Banks don't care about gold. Nothing could be further from the truth. Ben Bernanke, more than once, claimed that he didn't understand gold. When Ron Paul asked Bernanke in front of Congress why Central Banks own gold if it's irrelevant, Bernanke flippantly suggested that it was out of tradition. In both cases Bernanke was lying and he knew it. In comparison, Greenspan seemed to have some respect for the laws of economics and - at least that I can recall - never would outright state that gold was not an economic factor. Greenspan lied as much as Bernanke did about everything else but he never committed himself to lie about gold. Most of you have probably read Greenspan's 1966 essay, "Gold and Economic Freedom" (linked). I have read it several times because it explains as well as anything out there why gold works as a currency and why Government-issued fiat currency does not. What I find amazing about The Big Lie about Central Banks and gold is that if gold really is considered to be irrelevant, the how come Central Banks - especially the Fed - are so secretive about their gold storage and trading activities? What's even more amazing is that no one other than Ron Paul and GATA asks them about this. Think about it. GATA spent a lot of money on legal fees attempting to get the Fed to publicly disclose its records related to the Fed's gold activities. The Fed spent even more money denying GATA's quest. And how come the Fed won't submit to a public, independent audit of its gold vaults? This brings me to the issue of the Ukraine's gold. According to public records, the Government of Ukraine owns 33 tonnes of gold that was being safekept in Ukraine. Last week a Ukrainian newspaper reported that acting PM Arseny Yatsenyuk ordered the transfer of that gold to the United States. The actual report is here: LINK. Jesse's Cafe Americain provided a translated version here: LINK. On the assumption that the report is true, and so far I have not seen any commentary or articles suggesting it is not true, the biggest question is, how come the U.S. has absolutely no problem loading up and transporting 33 tonnes of gold from Ukraine to the U.S. but seems to have difficulty loading up and transporting any of Germany's gold from New York to Berlin? And how come the U.S. and Ukraine seem to care about that gold at all, if indeed gold is irrelevant? It would seem that it would be a lot less expensive and logistically complicated just to have the U.S. military post a few armed guards around the gold if they're worried about theft. On the other hand, I'm sure Putin would be happy to buy the gold from Ukraine. What makes the story even more interesting is that GATA's Chris Powell has spent considerable time trying to get an answer to the question of whether or not the U.S. has taken custody of Ukraine's gold. When he queried the NY Fed, they responded with: "A spokesman for the New York Fed said simply: "Any inquiry regarding gold accounts should be directed to the account holder. You may want to contact the National Bank of Ukraine to discuss this report" (LINK). After trying for two days to get an answer from the U.S. State Department, they finally responded by referring him to the NY Fed (LINK). The final piece in verifying that the report is true is deflection from Ukraine. Mr. Powell has queried the National Bank of Ukraine, the Ukrainian Embassy in DC, and the Ukrainian mission to the UN in NYC. Crickets. As Chris states the case: "The difficulty in getting a straight answer here is pretty good evidence that the Ukrainian gold indeed has been sent to the United States." Unfortunately, it is likely that the citizens of Ukraine will end up paying the same price for allowing the U.S. to "safekeep" their sovereign gold. That price is the comforting knowledge that their gold has been delivered safely to vaults in China under U.S./UK bullion bank contractual delivery obligations, where it will be locked away for centuries.

1 0