- cypherpunks - lists.cpunks.org

49 Page NSA analysis of Tor
by d.nix 05 Oct '13

05 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just published by Bart Gellman (Thanks Bart!): http://apps.washingtonpost.com/g/page/world/nsa-research-report-on-the-tor-… - -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (MingW32) iQEcBAEBAgAGBQJSTy2TAAoJEDMbeBxcUNAePB0H/0MxORH4Gs7zIpIojhzKS9pE YPQ0SmbXqLRhPKjllSAi+e24gIDzaj8yBDF9GQwv68u5lNSca/PFK2TVugx7mG/9 chQkmQCvBVbrtQ1mhCReLWxh6NCpUgEvvCRi5ZtvqfqBzxE22exb7tsTetDDezLh jVmq9CFCXdkDN6yNuHZ/5lC17feMBPj6nNEAuCX99V1236N3dbe52/ZpSb8uzC/b bGBmiGecc71wM4dMhjRMBJjxz1dMmKW1cImIj5StPJkDOD3beDX6EP7XE94b0Ts2 JVRi+NFPCRKqMpLhwlvmx0WtH5pLbcoxUmBGP3/Q8r+dgWUXdv+8Z8FFpMaJPFQ= =LDCN -----END PGP SIGNATURE-----

2 1

Re: [tor-talk] Guardian Tor article
by Al Billings 05 Oct '13

05 Oct '13

What makes you think that Chromium would be more secure? — http://makehacklearn.org On Fri, Oct 4, 2013 at 7:11 PM, Moses <moses.mason(a)gmail.com="mailto:moses.mason@gmail.com">> wrote: NSA mainly attack TOR user (not TOR itself) by exploiting vulnerabilities in Firefox. Should devs consider to replace the browser in TOR bundle with other browsers (such as chromium)?

1 0

Injustice: Denial of Disservice Attack
by Jim Bell 04 Oct '13

04 Oct '13

"INJUSTICE: DENIAL of DISSERVICE ATTACK" or, "How to really mess up the opponent, and to do so legally" By Jim Bell, Author of 'Assassination Politics'. I spent well over 13 years in prison, and not only was I not guilty of nearly all of the crimes of which I was charged, I was actually a victim of crimes committed by various Federal government employees. Not only was I assaulted on November 25, 1997 by a government stooge and informant, Ryan Thomas Lund, in order to force me to accept a plea agreement in case 97-5270, Tacoma Federal Court, I was also the victim of an amazing forged (falsified; fictitious; fake) appeal case (Ninth Circuit Court of Appeals, case 99-30210) that was initiated by corrupt government and court employees, and whose pre-April-2000 existence was concealed from me until about June 2003. Naturally, I concluded that something must be done about this. The current population of United States Federal prisons is approximately 220,000 inmates. (In 1980, that population was about 20,000). Each year, somewhat more than 70,000 new defendants are charged, and the large majority (perhaps 95%) are convicted. Yet, you might be surprised: There are only about 3,500 Federal criminal jury trials in America each year. The reason for the apparent difference is that in the vast majority of such cases, the defendant or defendants accept a plea agreement, which the news media wrongly refers to as a 'plea bargain': In reality, it's not a 'bargain' for the criminal defendant, and it certainly isn't a 'bargain' for the American taxpayer. See the "Prisoner's Dilemma". It's actually a financial disaster of the first magnitude, one which the majority of the American population doesn't know about, and certainly doesn't understand. But the reason the defendants are motivated to accept those deals is simple: The Feds threaten them with time far greater than what they'll get if they deal. So, the very large majority of them deal. And so, all of us are poorer as a consequence. The average sentence, we can calculate, is 220,000/70,000, or a bit over 3 years per sentence. (This is one way to calculate an 'average sentence', there may be others.) It costs approximately $35,000 to keep a prisoner in Federal prison for one year. So, for the 220,000 current prisoners, that's a total cost of about $7.7 billion dollars. If that population could be brought down to the level it was in 1980, or 20,000 prisoners, about $7 billion dollars would be saved. Even better, it would be far harder to extort people, people such as Barrett Brown (journalist), Kim Dotcom (Megaupload), Bradley Manning (Cablegate), Ladar Levinson (operator of Lavabit), Edward Snowden (NSA leaker), Ty Warner (Beanie Babies, just convicted of tax evasion) or (now) Ross William Ulbricht, alleged operator of 'Silk Road'. And, of course, thousands more that are less well-known. Many of these people have either not committed any crime at all, or even if guilty of something, they shouldn't be punished to the extent the system would want to do. Or punished at all. I was pondering this problem in my prison cell one day, and I got yet one more of my 'awfully wonderful, wonderfully awful' ideas. (Quote from: "How the Grinch Stole Christmas") I was almost as energized, and as enthusiastic, as I was in early 1995, when I got the idea that I later turned into my "Assassination Politics" essay. I thought, what if every Federal defendant could be motivated to refuse to deal, to refuse to accept the deal that's usuallyoffered. The figure of$5,000 popped into my head. What if every Federal felony criminal defendant were offered money, let's say $5,000, if they would plead not-guilty (which is their Constitutional right) and to demand a jury trial (which is also their Constitutional right). The current system has trouble putting on 3,500 Federal felony criminal jury trials per year. How would that system increase that number significantly? The number of Federal courtrooms is somewhat fixed, the number of U.S. Attorneys is rather limited as well. And, Federal court time has to be shared with civil cases, too. So, it would be hard to imagine a great increase in the number of Federal criminal jury trials held. If the number of persons convicted could be dropped from 70,000 per year to 4,000 per year, that should save the American taxpayers well over $7 billion per year in prison and jail costs. Well over 90% of Federal prisons would have to shut within 5 years. How much would this cost? Well, assuming a cost-per-offer of $5,000, and perhaps 4,000 trials per year, the cost would be $20 million per year. For an individual, that's a lot of money. But for an entire country, that's peanuts. Yet, it would save the nation $7 billion. In other words, for every dollar offered to a criminal defendant, the savings to the public would be: $7 billion/$20 million = $350. These estimates are not set in stone. Of course, under this kind of pressure 'the system' would tend to allocate its resources, the limited number of courtroom-days available, and would probably select only the most serious cases for prosecution. So, while it's possible that some residual amount of plea-bargaining would remain, this same pressure would tend to force officials to accept that defendants serve smaller average sentences than they've been getting, which of course are already much lower than they'd probably like to get. Even if the resulting average sentence rose to 4 years, the overall population of Federal prisons would drop from 220,000 to about 16,000. (4 years x 4,000 trials/year). This would be a great improvement. The big question is, "Who would pay for this?". "Therein lies the rub", to quote Hamlet. Don't expect bigtime drug-dealers to donate: Their ability to make money would be thwarted if their products were rendered de-facto legal. However, illegal-drug users would be greatly benefited. The price of their favorite pastime might very well drop by a factor of 5-10, if the likelihood of getting arrested and charged with providing it was drastically lowered. That would surely occur if this system was expanded to include state jurisdiction, which is about 10x larger than the Federal system, and thus a cost 10x higher: $200 million per year.. Another group of people who would benefit would be tax-evaders. The Wikipedia article on "Tax Evasion in the United States" indicates that the approximate money 'lost' (and thereby gained by non-payers) is $305 billion in 2010. If only 1/100 of a penny foreach dollar thus saved was paid into a fund, that would be $30.5 million, which would be plenty to make sure that Federal tax evasion would be extremely difficult to prosecute. As well as every other Federal crime. Most accountants would see that as a good investment, and should advise their clients accordingly. Jim Bell

3 4

Deterministic Builds Part Two: Technical Details
by coderman 04 Oct '13

04 Oct '13

Mike Perry has just posted the second half of his reproducible builds effort: "Deterministic Builds Part Two: Technical Details - This is the second post in a two-part series on the build security improvements in the Tor Browser Bundle 3.0 release cycle." https://blog.torproject.org/blog/deterministic-builds-part-two-technical-de…

1 0

USB Block Erupters as RNG sources?
by Jim Bell 04 Oct '13

04 Oct '13

From: d.nix <d.nix(a)comcast.net> To: cypherpunks(a)cpunks.org; liberationtech(a)mailman.stanford.edu Sent: Thursday, October 3, 2013 9:11 AM Subject: Re: USB Block Erupters as RNG sources? > "Very little", and "no". They're basically custom Bitcoin-mining > ASICs, I looked at one a while back for use in password-cracking >> and they're really not suited for it at all, you load a vector in >> and say "go" but since they're quite I/O-limited you can't easily >> adapt them for hash-breaking. As for RNG use, they're entirely >> deterministic, how would you use them as an RNG source? >> at best you *might* be able twist it into a DRBG that would still >> need to be seeded (and regularly reseeded) with robust entropy. >> >> these ASICs really are single purpose; they're useless for anything >> else. >Thanks Peter, Coderman- >Kinda what I suspected seeing as they are *Application Specific* IC's >after all... Wishful thinking more than anything knowing that they are >now saturating their market and loosing value rapidly. >Cheers! >DN This looks like a decent idea for a RNG. http://www.sciencedirect.com/science/article/pii/S1434841111001713 Another is: http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=847868&url=http%3A%2F… Yet another: http://www.fdk.co.jp/cyber-e/pi_ic_rpg100.html Jim Bell

1 0

GCHQ report on 'MULLENIZE' program to 'stain' anonymous electronic traffic - The Washington Post
by d.nix 04 Oct '13

04 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 GCHQ report on tainting Tor traffic: http://apps.washingtonpost.com/g/page/world/gchq-report-on-mullenize-progra… - -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (MingW32) iQEcBAEBAgAGBQJSTy+dAAoJEDMbeBxcUNAer08H/2NRjQx8k/Wj/juvWKLoV1Q8 57VSYlUYpjDT6Ut7MoMPPDy2qhjPoFgUnJhvDMLgOrpGBXrjuO/6PgBLkPASRZUU /qQRsaGmiAmn8Inw2V097ISnoTBQlnjxjBIyPCKUh4mg0kRfZGcuTNWGlgTmL0hr b11+Th23afjpK9Ip+y9OvJykfdcOjoX11JQge9J4JmVwaNWmmFBj/u3DsgiCk6b7 U5F5Q5yIeQ8MhsucsOuvNbK7QQEZHdRbx7IqgHWxxu1JOTLLClOIkILoHbGUBOxj QMPw1EZAcBNx7Gmb8m4UU7DuPkAEXAcT/8ABd53MXE80rM6nqWgODC49rKa3Mvc= =8lpg -----END PGP SIGNATURE-----

1 0

[tor-talk] Guardian Tor article
by Eugen Leitl 04 Oct '13

04 Oct '13

----- Forwarded message from Roger Dingledine <arma(a)mit.edu> ----- Date: Fri, 4 Oct 2013 11:38:10 -0400 From: Roger Dingledine <arma(a)mit.edu> To: tor-talk(a)lists.torproject.org Subject: [tor-talk] Guardian Tor article Message-ID: <20131004153810.GR31806(a)moria.seul.org> User-Agent: Mutt/1.5.20 (2009-06-14) Reply-To: tor-talk(a)lists.torproject.org Just to start off the new media frenzy thread. http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-a… http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraff… http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-pre… (Did I miss any good links?) Enjoy, --Roger -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 1

Re: [tor-talk] Guardian Tor article
by grarpamp 04 Oct '13

04 Oct '13

Some have said... > this [Snowden meta arena] has been a subject of discussion on > the [various] lists as well > Congrats, torproject :-D > "Tor Stinks" means you're doing it right; good job Tor devs :) > good news everybody; defense in depth is effective and practical! Yes, fine work all hands, everyone have a round at their favorite pub/equivalent tonight. > Of course, this is also from 2007. It's been a long time since then. Yet whether from 2007 or last week... when Monday rolls around, we must channel all this joy and get back to work. For the risks and attackers that we all face are real, motivated, well funded, and do not play fair by any set of rules. They do not stop and neither can we. Wins that do not result in elimination from the game are but temporary gains. We must always be better... train, practice, discipline, and enter ourselves into every race... leaving only a continuous cloud of dust behind for our adversaries to choke on. Till Monday, I got this round :)

1 0

Re: cypherpunks Digest, Vol 4, Issue 9
by Softy 04 Oct '13

04 Oct '13

was that eight pages of fun reading rambling just to end with ... "because crypto is in too many mathematical dimensions to model in origami, or any other Earthly physical medium" ... or did I miss a crucial middle paragraph? oh please oh please I hope people replying to this thread don't re-send the original in full.

5 4

Re: [tor-talk] Guardian Tor article - better endpoint and application security
by Eugen Leitl 04 Oct '13

04 Oct '13

----- Forwarded message from coderman <coderman(a)gmail.com> ----- Date: Fri, 4 Oct 2013 09:50:14 -0700 From: coderman <coderman(a)gmail.com> To: tor-talk(a)lists.torproject.org Subject: Re: [tor-talk] Guardian Tor article - better endpoint and application security Message-ID: <CAJVRA1S7tVsWtLWOkRe0O3xWnKJ0+GD9JcC+BohQSYi-BhqxdA(a)mail.gmail.com> Reply-To: tor-talk(a)lists.torproject.org On Fri, Oct 4, 2013 at 8:44 AM, defcon <defconoii(a)gmail.com> wrote: > ... We need to focus more on secure browsers and tools that work over TOR > since they are relying on browser exploits and hacking services on TOR. "p7 Tor Project and friends Recent Activity" http://www.theguardian.com/world/interactive/2013/oct/04/tor-high-secure-in… """ Tails: ... Adds Severe CNE misery to the equation ... """ good news everybody; defense is depth is effective and practical! this has been a subject of discussion on the Qubes devel list as well, in the content of Whonix, Tails and other Tor packagings. http://theinvisiblethings.blogspot.com/2011/09/playing-with-qubes-networkin… https://www.whonix.org/wiki/Comparison_with_Others qubes devel threads of interest: "Qubes + Whonix" https://groups.google.com/forum/#!topic/qubes-devel/2vnGqsoM9p0 "QuebesOS - Secure Against Spying?" https://groups.google.com/forum/#!topic/qubes-devel/UfmWWiq9-_U "Disposable VM versus local forensics?" https://groups.google.com/forum/#!topic/qubes-devel/QwL5PjqPs-4 best regards, -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0