- cypherpunks - lists.cpunks.org

The Unbreakable Cipher
by John Young 26 Sep '13

26 Sep '13

NSA Technical Journal published "The Unbreakable Cipher" in Spring 1961. http://www.nsa.gov/public_info/_files/tech_journals/The_Unbreakable_Cipher.… Excerpts: [Quote] David Kahn, "Lyen Otuu Wllwgh WI Etjown" pp. 71, 83, 84, 86, 88 and 90 of the New York Times Magazine November 13, 1960 says that an unbreakable cipher system can be made from one time key "that is absolutely random and never repeats." ... For each cipher system there is an upper bound to the amount of traffic it can protect against cryptanalytic attack. What is "cryptanalytic attack"? It is a process applied to cipher text in order to extract information, especially information contained in the messages and intended to be kept secret. If some of the information is gotten by other means and this results in more being extracted from the cipher, this is (at least partially) a successful attack. If certain phrases can be recognized when they are present, this is successful cryptanalysis. If a priori probabilities on possible contents are altered by examination of the cipher, this is cryptanalytic progress. If in making trial decipherments it is possible to pick out the correct one then cryptanalysis is successful. ... Another example is that of Mr. Kahn, one-time key. Here the limit is quite clear; it is the amount of key on hand. The key arrives in finite "messages," so there is only a finite amount on hand at anyone time, and this limits the amount of traffic which can be sent securely. Of course another shipment of key raises this bound, but technically another cipher system is now in effect, for by my definition a cipher system is a message. A sequence of messages is a sequence of cipher systems, related perhaps, but not the same. ... [Answer to the question:] "Does there exist an unbreakable cipher" would be this, "Every cipher is breakable, given enough traffic, and every cipher is unbreakable, if the traffic volume is restricted enough." [End quote] Is this conclusion still valid? If so, what could be done to restrict traffic volume to assure unbreakablility? And how to sufficiently test that. Presuming that NSA and cohorts have investigated this effect.

2 1

Re: [cryptography] The Compromised Internet (2)
by brian carroll 26 Sep '13

26 Sep '13

> So beyond mathematically-enthroned encryption what lies awaiting > disclosure. > forgot to mention as referenced, the role of music as a form of cultural communication with potentially secret dimensions this whether classical, with entire societies networked around a given aesthetic hub or node, else within traditions themselves of various society's and the institutions these can become or the universalization of rock & roll music and the 'rock concert' as a seeming height of 20th century western popular culture, tied into mass media and media archives and vast shared communication, to include role of drug culture and consciousness and politics, including counterculture agenda, and role of trends and fashion that align with this as a form of monocultural megadevelopment who knows, perhaps those strobe and laser light displays are outputting more data, or a guitar solo is a data transmission on some other level, as carrier wave for hidden signaling. it seems for deadheads, for instance, acid may open up their experience of the music that otherwise may be intolerable and likewise maybe there are lissajous figures spinning in skulls as the result of entrainment of populations via these mind and brain-washing techniques of neurology brought into the context of mass music and its technical devices, so to program populations without their even knowing it. in this way 'communications science and engineering' may have more to do with signaling in music or as a means for programming behavior, than the music itself, if taken in a covert context. add sex, drugs, popularity and money and group-behavior and you got a platform to exploit and run against others in their own channels, (though it could tend towards baseness, bottom feeding and constitute a dumb-system by comparison to others) speculation of course. just like that wireless speaker is in no way connected to a retail dual-use spying agenda

1 0

Snowden walked away with the U.S. IC Intellipedia
by John Young 26 Sep '13

26 Sep '13

A sends: "Snowden walked away with the U.S. IC Intellipedia." http://en.wikipedia.org/wiki/Intellipedia Information on the validity of this claim invited: cryptome[at]earthlink.net

1 0

Re: [cryptography] The Compromised Internet
by brian carroll 26 Sep '13

26 Sep '13

> So beyond mathematically-enthroned encryption what lies awaiting > disclosure. > * data-loggers within dental work, synced via multiband x-rays (+ secret other, say tetrahertz), this much easier facilitated via digital equipment note: could be synced to infrastructure tagging or mapping networks via RFID-like send/receive and also monitor biological events of the person * the often interesting TV series "It Takes a Thief" with Robert Wagner had one episode of a fashion designer who (if remembering correctly) stitched a pattern into a new dress that was then photographed or it may have had something to do with a microdot, James Earl Jones was the designer in that episode * the possibility of food for data transmission related to eating certain Asian food and having a gland open on the roof of my mouth- seemingly a specific chemical and what could happen if that were related to triggering of various related socio-behavioral programming, etc. * the future possibility, given data transfer by touch, of data capsules or pills that are digested and relay code that is informational into accompanying cyborg implant, else also behavioral routines triggered by food or drugs, that of an informational domain (which in a context of medicine and the body could be very wide ranging). heck, what about non-lethal overtones of morse code onto pacemaker or other devices, as form of signaling * microphoned dinner tables to relay info to flower vase, also tapping out code onto surface for solitar diners * clothing design, again, if embedded systems for data relay, also with jewelry. seemingly it could be anything. different kinds of materials or stitching, fashion styles as communication systems, delineating networks and establishing standards, references, and protocols, hidden technology or encrypted 'data', non-electronic or to be mediated electronically- say thread that glows in black light only, one-time pad, person walks past special camera-trap to relay data w/out even knowing * genetics themselves, various data sets as langauge including categorization as a means of encrypting perspectives, setting boundaries within contingent modeling of pseudo-truth, thus thresholds/boundaries for what can be perceived from the inside and outside; as this relates to disease, health systems, insurance, death panels, hidden eugenics of targeted populations * infrastructure itself as pre-internet sensor network with capacity for secret communications, especially with the mystery networked sensor boxes logging mystery data. could trace chemicals in products to pattern match and refine facial recognition, retail pollution of industrial scent as perfumes (another potential communication system), deodorants, shampoos combined mark, assist tracking * vehicles themselves if carrying paired black-box tech with shared non-identifiable encryption formats, such that a drive-thru or drive-by could involve data exchange, as this could likewise potentially relate to modification of street lights, electronic gates, toll booths, traffic lights and potentially any form of electronic signage (as this also relates to NFC and RFID for tracking, signaling). thus vehicles as data loggers and data carriers which may or may not involve drivers knowledge. if so, covert data exchange could seemingly exist outside of known encryption formats as a strengthening of security by the obscurity (akin to inventing secret, private language) whereas known algorithms could indicate, compromise systems via existing standards ("this is secret data!") * issue of black market and courier services, in some sense transfer of weapons and illegal drugs assumes an extreme form of privacy, security, and secrecy such that a small amount of opium could be couriered to a US resident and paid for by "anonymous" money, and in some sense similar to being ~encrypted, assuming or betting against disclosure of surveilling of packaging by companies, or of data inside encrypted archives thus like betting on the odds of the long-game * then there is peer-to-peer signaling in itself, public and- or private, one to one or one to many or relay or delayed via written, oral, sound-based, food, fashion, or other communication -- of the realm of symbolic language where something stands-in for something-else or 'shared meaning' can be effectively communicated yet exist beyond the boundary of others perception; a shared framework of "truth" (whether true or not) is required as a protocol to match up shared dimensions; overt is hand gestures, hand signals, body movements, postures, poses, facial expressions, as language * i tend to think there is potential for any language-based interaction to involve signaling that is observed differently by others, based on their relation to the event or reading of it- for instance, juggling. it is a pattern-based activity that has known and identifiable sequences that can be a way of communicating (by those so skilled) or could involve use of color or number or other dynamics to signal or secretly message another who operates or understands the same 'cipher system'. LED equipment that can be programmed, or even IR or UV that may not appear activated yet could be photographed or video'd in those frequencies could then reveal a data stream, or potentially involve persistence of vision or even a data-burst relayed or captured by camera or cellphone * anything, like RC planes or models driving down a street and triggering a data exchange, with vehicle house router house monitoring system, infrastructure, as a potential; * maybe reconsider Grandma's framed needlepoint sometime or the role of collectibles or the anthro- and archaeological involved in antiques as potential forms of secret data exchange, in that that period furniture or rare object may signify something to someone and trigger a meaningful relational exchange that could, in certain instance, function and establish a data network and allow hidden communication and conscious to exist, persist and in this way- aesthetic probably trumps all things electronic in terms of the bandwidth involved in pure sensory experience, thought, knowledge, shared consciousness, and secret views that to the outsider may exist as encrypted, beyond awareness and understanding or even value, even while it could be primary (basis for shared awareness, decision making, action for others)

1 0

Re: [cryptography] The Compromised Internet
by grarpamp 26 Sep '13

26 Sep '13

On 9/25/13, Greg Rose <ggr(a)seer-grog.net> wrote: > Even under the much-relaxed export laws of the US, deriving spreading > information cryptographically is a prohibited export. Which isn't to say it > is not a good idea. The US only applies to itself. Further, over the air, it's noise, the crypto is undetectable and unprovable. And it's (guerilla) software, not physical commercial product. Nor is this the old 'FCC says you can't encrypt ham bands' argument/tech.

1 0

Re: The Compromised Internet
by John Young 25 Sep '13

25 Sep '13

Yes, along those lines. Free of the totally seductively entrapping internet and monomanical PK promiscuity. The slew of innovations to milk the internet and crypto are way stations toward surpassing vulns of both used in concert. Both mutually delude. Each might lead to better alone, paired with different and less familiar means. At 04:29 PM 9/25/2013, you wrote: >Free and Open 4G radios/base stations are actually quite exciting >for this reason. The thing which actually prevents mesh networks >from working is mathematical: past a certain network size, path >finding becomes too computationally expensive, so wifi based mesh >networks can only cover a certain radius before they stop working. >With the 4G spectrum, however, the distances between hops vastly >increases, meaning that city-wide mesh networks can grow and remain >performant. This allows for free communication and file transfer >without centralized authorities. Obviously there are still threats, >but there is a lot of freedom gained from network autonomy.

1 0

Re: [cryptography] The Compromised Internet
by John Young 25 Sep '13

25 Sep '13

At 04:36 PM 9/25/2013, you wrote: > What threat are you trying to prevent that isn't already solved > by the use of cryptography alone? Transceiver vulnerabilities of the Internet, seemingly inherently insecure by design. So looking for possibilities of moving encrypted goods by other means not betrayed by faulty shipment and addled by ubiquity and familiarity. Not that that is original by any stretch, wizards are jawing about a new internet, secure by design. May take a while, so workarounds of the present piece of carrion might be useful. Not to overlook a new-fangled Snowden loosening the controls of comsec technology beyond his and our PK-packet-tech era comprehension. So beyond mathematically-enthroned encryption what lies awaiting disclosure. Oldies might suffice if dutifully studied and elaborted. Thus the reference to NSA's backroom of pre-internet-PK comsec tech which could be in the forefront, cutting/bleeding edge.

1 0

Re: [guardian-dev] APK signing keys are vulnerable WAS: pgp, nsa, rsa
by Eugen Leitl 25 Sep '13

25 Sep '13

----- Forwarded message from Hans-Christoph Steiner <hans(a)guardianproject.info> ----- Date: Wed, 25 Sep 2013 16:19:58 -0400 From: Hans-Christoph Steiner <hans(a)guardianproject.info> To: guardian-dev(a)lists.mayfirst.org Subject: Re: [guardian-dev] APK signing keys are vulnerable WAS: pgp, nsa, rsa Organization: The Guardian Project User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.0 Also, we should document how to generate a good signing key. Pd0x just recommended this in #guardianproject: keytool -genkey -v -keystore test.keystore -alias testkey -keyalg RSA -keysize 8192 -sigalg SHA256withRSA -dname "cn=Test,ou=Test,c=CA" -validity 10000' .hc On 09/23/2013 03:15 PM, Natanael wrote: > How are you planning on doing it? Will you let the old app notify the user > about having to install a new app, maybe pointing to Google Play or > offering a direct download? After verifying that the import worked, you can > also offer to open the app details in Android for the old app so quick > uninstallation is easy. Have you written down the details anywhere yet? I'd > like to see how you're planning on doing it. > > Den 23 sep 2013 20:44 skrev "Abel Luck" <abel(a)guardianproject.info>: >> >> Yup, we just outlined this process in IRC :) >> >> Anyone have a snippet of Java that lets an app check another app's >> signing key? >> >> ~abel >> >> >> Natanael: >>> I can only see one option that is plausible - update the old app, signed >>> with the old key, to be able to export it's data. You can't install a > new >>> app in the place of the old one and just keep data, Android will require >>> that you uninstall the old app before you install the new one if their >>> package names are identical but signing keys differ. >>> >>> To improve security for the data transfer to some degree, we could use >>> Intents to let the new app request the data from the old app, and > ideally >>> the old app would verify which key the new app is signed with, and > prompt >>> the user for authorization. Then the user would only need to install the >>> new app, open it and select "Import from the old app", click OK, and > then >>> uninstall the old app. >>> Den 23 sep 2013 19:47 skrev "Abel Luck" <abel(a)guardianproject.info>: >>> >>>> Daniel McCarney: >>>>>> Wow, that is bad news indeed. It would be awesome to have >>>> androidobservatory.org also display full info about the signing keys, >>>> like the algorithm used, the bitness, generation date, etc. so we can >>>> easily check which keys are vulnerable. >>>>> >>>>> Working on rolling that functionality out. I had to rewrite the app >>>> import >>>>> pipeline so that I could store that information. I have the data >>>> collected but >>>>> it isn't user facing yet. I can tell you that looking at the ~6,000 >>>> unique >>>>> certificates in the observatory data about 75% are RSA 1024. >>>>> >>>>> As far as I'm aware it isn't possible to learn the key generation date >>>> from the >>>>> certificate data in the PKCS7 structure stored in the META-INF > directory >>>> of an >>>>> APK. >>>>> >>>>>> I figure if the NSA can break 1024 bit RSA, its only a matter of time >>>> before China also has that capability. China are experts at industrial >>>> espionage, and they certainly know how to make chips. It is very >>>> conceivable that they could acquire the NSA's RSA cracking chip design > and >>>> then build it domestically. Then I imagine that China would also be >>>> willing to sell those chips to allies, or perhaps even the highest > bidder. >>>>> >>>>> Yeah, the current NIST[1] advice on key sizes is very clear that 1024 >>>> bit RSA >>>>> should be deprecated (though evidently NIST might not be an unbiased >>>> source of >>>>> information...). >>>>> >>>>>> We'll have to make sure our signing key is not 1024 bit, and if so, >>>> work on a migration plan. The easiest way to start is to sign all new > apps >>>> with a new key. >>>>> >>>>> The pubkey in the cert used for the core Guardian Properties > (ChatSecure, >>>>> Obscuracam, etc) is definitely 1024 RSA. So is the pubkey in the cert >>>> used for >>>>> Orweb. It would definitely be a good idea to start talking about >>>> migration >>>>> plan, (and using a strong keysize in a new cert for all new > properties) >>>>> >>>>> - Dan >>>>> >>>> >>>> Hm, this seems quite important. Is there any established docs on how to >>>> perform a key migration without data loss? >>>> >>>> Also, I think we should make a blog post advisory out of this. >>>> >>>> ~abel >>>> >>>> _______________________________________________ >>>> Guardian-dev mailing list >>>> >>>> Post: Guardian-dev(a)lists.mayfirst.org >>>> List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev >>>> >>>> To Unsubscribe >>>> Send email to: Guardian-dev-unsubscribe(a)lists.mayfirst.org >>>> Or visit: >>>> > https://lists.mayfirst.org/mailman/options/guardian-dev/natanael.l%40gmail.… >>>> >>>> You are subscribed as: natanael.l(a)gmail.com > > > > _______________________________________________ > Guardian-dev mailing list > > Post: Guardian-dev(a)lists.mayfirst.org > List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev > > To Unsubscribe > Send email to: Guardian-dev-unsubscribe(a)lists.mayfirst.org > Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/hans%40guardianproj… > > You are subscribed as: hans(a)guardianproject.info > -- PGP fingerprint: 5E61 C878 0F86 295C E17D 8677 9F0F E587 374B BE81 _______________________________________________ Guardian-dev mailing list Post: Guardian-dev(a)lists.mayfirst.org List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To Unsubscribe Send email to: Guardian-dev-unsubscribe(a)lists.mayfirst.org Or visit: https://lists.mayfirst.org/mailman/options/guardian-dev/eugen%40leitl.org You are subscribed as: eugen(a)leitl.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

DARK WALLET: A RADICAL WAY TO BITCOIN
by Eugen Leitl 25 Sep '13

25 Sep '13

"radical", huh. http://www.newyorker.com/online/blogs/currency/2013/09/dark-wallet-bitcoin.… DARK WALLET: A RADICAL WAY TO BITCOIN POSTED BY MICHAEL DEL CASTILLO Cody Wilson is a twenty-five-year-old former law student at the University of Texas at Austin. He is also the inventor of the Liberator, a gun made almost entirely from plastic pieces created with a 3-D printer; he also uploaded to the Internet a blueprint that anyone could use to print such a gun. Wilson, who espouses libertarian views, created the blueprint to make a point: information should be free. Not everyone agreed with him. In May, after Wilson successfully fired the gun at a range near Austin and posted the design online, the State Department requested that those files be removed from the Web site of his nonprofit, Defense Distributed. Wilson complied—but not before the files had been downloaded two hundred thousand times, igniting a debate about whether there should be limits to the free flow of information over the Internet, and over the role of the government in enforcing those restrictions. Wilson lives in “a utopian world in which contraband will be only a notional concept, because enforcement will require policing ideas and blueprints, not simply goods,” Jacob Silverman wrote in a piece about Wilson and the Liberator in May. A native of Cabot, Arkansas—a small suburb of Little Rock—Wilson said that the State Department’s action persuaded him to drop out of law school and pursue revolutionary activities full-time. In fact, he had been planning his next endeavor for a while. When Indiegogo, a crowdfunding site, booted Defense Distributed’s campaign in August, 2012, for violating its terms of service—Indiegogo said the project related to the sale of firearms; Wilson said it was for the creation of information—Wilson began to raise money by asking people to support him using a currency called Bitcoin: encrypted, difficult-to-trace bits of code that function like cash and can be exchanged over the Internet without a bank or a PayPal account. Wilson said that he eventually raised two hundred bitcoins for the Liberator—the equivalent of twenty-seven thousand dollars, according to the current exchange rate. His efforts attracted the attention of a twenty-five-year-old Brit named Amir Taaki, who e-mailed him with an invitation to speak at the Bitcoin 2012 Conference, in London. He accepted. Wilson and Taaki met in person for the first time in January of 2013, when Taaki took Wilson to visit a workspace for hackers is Bratislava, Slovakia, and to anarchist squats in London. They reconnected in Berlin that July and began hashing out a plan to use the as of yet unregulated, untaxed, nearly untraceable currency in a way that would, like the Liberator, undermine the ability of governments to regulate the activities of their citizens. In the Bitcoin world, where banks no longer serve as intermediaries between people and their money, bank accounts have been replaced by online “wallets” that people can use to virtually store and send bitcoins. Wilson and Taaki’s project, tentatively known as Dark Wallet, is a simple wallet designed to be easier to use for people who aren’t tech-savvy; they hope that in turn accelerates the currency’s rate of adoption around the world. The wallet will be open-source and free to use. Eventually, Wilson and Taaki hope to create a vast stable of Bitcoin-related tools. The goal, for Wilson, is similar to what he tried to do with the Liberator: use technology to remove government intervention from his life, and from the lives of like-minded people. Unlike many current Bitcoin wallets, which can be difficult to download and cumbersome to use, Wilson and Taaki are designing Dark Wallet, they told me, as an easy-to-install plug-in that sits discreetly on users’ Chrome or Firefox browsers. Made for Windows, Mac, and Linux computers, Dark Wallet would move most of the energy-sucking process of insuring there’s only one of each bitcoin in circulation, and that they aren’t spent in two places at the same time, to separate servers. Wilson still lives in Austin, working remotely on Dark Wallet with Taaki, who lives in an anarchist compound called Calafou, outside of Barcelona, and writes most of the code behind the wallet. Taaki and Vitalik Buterin, the co-founder of Bitcoin Magazine, a periodical covering the currency, are part of a Calafou-based organization called unSystem, which came up with the idea for the wallet; they’re working with a team of developers from around the world. Wilson, who will manage the development team behind Dark Wallet, making sure they meet their targets on time, is also producing a video and other material for a crowdfunding campaign to raise money for the project. Dark Wallet should be ready sometime in January or February of 2014, Taaki said, though he’s not committing to anything. “It’ll launch when it’s ready,” he said. And the details of an upcoming crowdfunding campaign have still yet to be solidified, though Taaki and Wilson expect it to launch sometime in October. The person or group that, in 2008, created Bitcoin—that is, released the protocol that defined what Bitcoin would be—called itself Satoshi Nakamoto. The online comments that Satoshi Nakamoto made before disappearing completely, in 2012, indicate that the creator of Bitcoin, like Wilson, was deeply mistrustful of economic institutions and designed the currency to be intentionally subversive. Bitcoin is created, or “mined,” as it’s called, by powerful computers that race to solve complex math problems and are rewarded for their work with the encrypted code that is a bitcoin. Today there are 11.7 million of the coins in existence, worth an estimated $1.6 billion, though their value fluctuates dramatically. Nakamoto set the number of coins entering circulation to halve every four years until 2140, when they will plateau at twenty-one million coins and never be produced again. Because no one can arbitrarily decide to print more bitcoins, and because no banks intermediate the storage and spending of the currency, the value of a bitcoin is determined by market demand. Wilson finds this very attractive. But where a currency exists, capitalism will inevitably find it. In recent months, Bitcoin has caught the attention of entrepreneurs, many funded by venture-capital firms, who have begun building Bitcoin-related start-ups. The companies include exchanges where people can trade bitcoins, along with services that let people store and spend the currency in places ranging from Amazon-style online markets to brick-and-mortar bars and restaurants. The mainstream entrepreneurs who are interested in Bitcoin have found a haven in a nonprofit called the Bitcoin Foundation. Writing about Bitcoin in April, Maria Bustillos described its executives as a “rational and sober group of adult administrators” who stand in contrast with the image of Bitcoin users as “wild-eyed kids camping out in half-deserted lofts.” Members of the foundation met in August with several federal agencies, including the Federal Reserve, the F.B.I., and the Secret Service. On the surface, the meeting was an educational exercise, meant to explain how Bitcoin works, but many observers assume it was a step toward regulating the currency. The foundation, which celebrates its first anniversary this month, calls itself an advocacy group “dedicated to serving the business, technology, government relations, and public affairs needs of the Bitcoin community.” One goal, according to Jon Matonis, its executive director of the Bitcoin Foundation, is to educate both public and private interests—including the government—about how the currency operates. (“The Foundation is not pro-regulation as some have claimed, but it is pro-education,” Matonis has written, adding that he supports “bitcoin education for legislative and regulatory entities” and that “lobbying on behalf of Bitcoin is not necessarily anti-market.”) Wilson, not surprisingly, sees working with the government as a betrayal of Bitcoin’s fundamental purpose. “The public faces of Bitcoin are acting as counter-revolutionaries,” he told me. “They’re actively working to try to diffuse it, and to pollute it.” He was referring, he said, not only to the Bitcoin Foundation but to venture capitalists and entrepreneurs in New York and Silicon Valley who increasingly embrace the currency as a way to profit, but don’t share his revolutionary aims. (Matonis said he is aware of Wilson’s concerns. “I don’t see my role as advancing crony capitalism,” he said.) Wilson believes Bitcoin should remain the backbone of a separate economy that undermines the government’s ability to collect taxes and to control the value of currency—not be subsumed into the mainstream economy. “The state is basically allowed because we have all chosen to use these certain institutions to channel our activity and commerce,” he told me. “But when we are enabled, through alternative means and technologies, to channel our commerce as we will, channel our production as we will, the state simply disappears.” Not everyone agrees, of course, that society would benefit from the disappearance of governments. Wilson used the Liberator to make the point that the government shouldn’t regulate the flow of information; he wants to use Bitcoin to help build an economy outside of the government’s reach. But his ideology, taken to its logical conclusion, would also leave services like roads, libraries, fire fighting, and policing in the hands of the private sector—whose interests may not be aligned, Wilson’s critics argue, with those of the public at large. Wilson knows that he could see blowback for his stance against the foundation: as a self-described “crypto-anarchist,” perhaps he shouldn’t be so concerned with who is or isn’t determining the currency’s future. And if the U.S. government attempts to regulate the currency, which seems likely, Wilson will also find himself once again in direct opposition to the government. Wilson and the suit-and-tie-wearing people at the Bitcoin Foundation share a common interest in bringing Bitcoin to as many people as possible. The foundation seems willing to play nicely with the establishment, and has been open to hearing about the interests of old-school players like venture capitalists and government regulators. Wilson, however, who was only recently firing an illicit gun into the desert, isn’t looking only for a new currency but for another way to liberate himself—and others—from government oversight. Michael del Castillo is the technology and innovation reporter at Upstart Business Journal, a member of American City Business Journals, which is a sister publication to Condé Nast. A graduate of Columbia University, he is also the cofounder of Literary Manhattan, a nonprofit dedicated to promoting Manhattan’s literary community and creating new ways to appreciate literature. Illustration by Grafilu.

2 1

[tor-talk] Tor Weekly News — September 25th, 2013
by Eugen Leitl 25 Sep '13

25 Sep '13

----- Forwarded message from dope457 <dope457(a)riseup.net> ----- Date: Wed, 25 Sep 2013 14:15:43 +0200 From: dope457 <dope457(a)riseup.net> To: tor-talk(a)lists.torproject.org, tor-news(a)lists.torproject.org Subject: [tor-talk] Tor Weekly News — September 25th, 2013 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.0 Reply-To: tor-talk(a)lists.torproject.org ======================================================================== Tor Weekly News September 25th, 2013 ======================================================================== Welcome to the thirteenth issue of Tor Weekly News, the weekly newsletter that covers what's happening in the well-heeled Tor community. Reimbursement of exit operators ------------------------------- In July 2012, Roger Dingledine wrote a post on the Tor blog [1] in which he raised the prospect of offering funding to organizations running fast Tor exit nodes. In so doing, Roger wrote, “we will improve the network's diversity as well as being able to handle more users.” He also announced that donors were already interested in financing such a scheme. Then, in April this year, Moritz Bartl stated [2] that torservers.net was looking to move away from establishing additional exit nodes, in favor of providing support of various kinds to partner organizations running their own exits. These plans, and the discussion they provoked, are now about to bear fruit in the form of a financial reimbursement scheme directed at torservers.net's partner organizations. Moritz wrote again on the the tor-relays list [3] to announce that reimbursements are scheduled to begin at the end of this month, drawn from a one-time donation by the U.S. Government's Broadcasting Board of Governors. The ensuing debate focused both on the technical aspects of reimbursement — that is, how best to determine the division of funds based on information harvested from the network metrics [4] — and the question of the security issues that could potentially arise from such a scheme [5]. Moritz specified that currently the only organizations to qualify for reimbursements are those that he personally knows: “so, if you’re interested in becoming a partner, start social interaction with me”, he wrote. Questions or comments regarding these proposals are welcome on the tor-relays list, and further announcements and discussion about the reimbursement system will be published on its dedicated mailing lists [6]. [1] https://blog.torproject.org/blog/turning-funding-more-exit-relays [2] https://lists.torproject.org/pipermail/tor-relays/2013-April/001996.html [3] https://lists.torproject.org/pipermail/tor-relays/2013-September/002824.html [4] https://lists.torproject.org/pipermail/tor-relays/2013-September/002825.html [5] https://lists.torproject.org/pipermail/tor-relays/2013-September/002831.html [6] https://lists.torproject.org/pipermail/tor-relays/2013-May/002138.html Tails 0.20.1 is out ------------------- Tails saw its 33rd release on September 19th [7]. The most visible change might be the upgrade of tor to version 0.2.4.17-rc, which should result in faster and more reliable access to the network after the sudden bump in Tor clients [8]. Among other minor bugfixes and improvements, persistence volumes are now properly unmounted on shutdown. This should prevent data loss in some situations, and avoid a sometimes lengthy pause upon activation. It also fixes several important security issues [9]. It is recommended that all users upgrade as soon as possible [10]. [7] https://tails.boum.org/news/version_0.20.1/ [8] https://blog.torproject.org/blog/how-to-handle-millions-new-tor-clients [9] https://tails.boum.org/security/Numerous_security_holes_in_0.20/ [10] https://tails.boum.org/news/version_0.20.1/ New Tor Browser Bundles released -------------------------------- A new set of stable and beta Tor Browser Bundles was released [11] on September 20th. The Tor Browser is now based on Firefox 17.0.9esr and fixes several important security issues [12]. Queries for the default search engine, Startpage, are no longer subject to its invasive “family filter” [13]. The beta branch also include an updated version of HTTPS Everywhere that no longer causes a storm of requests to clients1.google.com, an issue reported by many users after the last release [14]. Once again, it is recommended that all users upgrade as soon as possible. [11] https://blog.torproject.org/blog/new-tor-browser-bundles-firefox-1709esr [12] https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html#fire… [13] https://bugs.torproject.org/8839 [14] https://bugs.torproject.org/9713 Tor mini-hackathon at GNU 30th Anniversary Celebration ------------------------------------------------------ Nick Mathewson sent an invitation [15] encouraging everyone to attend the GNU 30th Anniversary Celebration [16] on September 28th and 29th at MIT, Cambridge, MA, USA. Part of the event is a hackathon, and Tor is featured alongside a few other projects. If you want to spend some of the weekend helping the Tor community, sign up on the webpage [17] and come along! [15] https://lists.torproject.org/pipermail/tor-talk/2013-September/030154.html [16] https://gnu.org/gnu30/celebration [17] https://crm.fsf.org/civicrm/event/register?id=10 Clock skew: false alarm ----------------------- Small offsets in system time offer an attractive opportunity for fingerprinting Tor clients. In order to eliminate unnecessary exposure, Nick Mathewson has been working on proposal 222 [18]. Unfortunately, this process introduced a bug into the tor daemon which became apparent after the directory authority named “turtles” was upgraded. The result was that relays started to warn their operators of an implausible clock skew [19]. This was, of course, a false alarm. The issue was quickly worked around, and fixed properly a few hours later [20]. [18] https://gitweb.torproject.org/torspec.git/blob_plain/refs/heads/master:/pro… [19] https://lists.torproject.org/pipermail/tor-relays/2013-September/002888.html [20] https://bugs.torproject.org/9798 Tor Help Desk Roundup --------------------- One user contacted the help desk for assistance running torbrowser, an application not affiliated with the Tor Project that attempts to mimic the Tor Browser Bundle. The torbrowser application violates the Tor Project’s trademark, and the Tor Project encourages users to avoid it. Multiple Tor Project developers have contacted SourceForge, which hosts this application’s website, attempting to get the project removed. Andrew Lewman has said that lawyers have now been engaged [21]. A number of University students continued to contact the help desk to report difficulties circumventing their University’s Cyberoam firewall. These students report being unable to access the Tor network even when using the Pluggable Transports Browser with obfs3 bridges. One person reported success circumventing the firewall when using an obfsproxy bridge on port 443. This issue is ongoing, but a bug report has been filed [22]. [21] https://lists.torproject.org/pipermail/tor-talk/2013-August/029614.html [22] https://bugs.torproject.org/projects/tor/ticket/9601 Miscellaneous news ------------------ Jacob Appelbaum inquired with VUPEN about the Tor Project having the right of first refusal for Tor Browser bugs, in order to protect users [23]. [23] http://storify.com/fredericjacobs/discussion-between-tor-s-ioerror-and-vupe… The proposed Tor page on Stack Exchange has now reached 100% commitment, and will soon be launching as a live beta. Thanks to everyone who signed up! [24]. [24] http://area51.stackexchange.com/proposals/56447/tor sajolida reported on the latest Tails “low-hanging fruits session”. The date and a tentative agenda for the next online contributors meeting have also been set [25,26]. [25] https://mailman.boum.org/pipermail/tails-dev/2013-September/003703.html [26] https://mailman.boum.org/pipermail/tails-dev/2013-September/003696.html As GSoC entered its final phase, Kostas Jakeliunas reported on the searchable metrics archive [27], Johannes Fürmann on EvilGenius [28], and Cristian-Matei Toader on Tor capabilities [29]. [27] https://lists.torproject.org/pipermail/tor-dev/2013-September/005483.html [28] https://lists.torproject.org/pipermail/tor-dev/2013-September/005484.html [29] https://lists.torproject.org/pipermail/tor-dev/2013-September/005490.html How can we provide Tor users an easy way to verify the signatures on Tor software? Sherief Alaa raised this question on the tor-dev mailing list when asking for comments on plans to write a “small” GUI tool [30]. [30] https://lists.torproject.org/pipermail/tor-dev/2013-September/005491.html Upcoming events --------------- Sep 28-29 | Tor mini-hackathon at GNU 30th Anniversary Celebration | MIT, Cambridge, Massachusetts | https://gnu.org/gnu30/celebration | Sep 29 | Colin at the Winnipeg Cryptoparty | Winnipeg, Manitoba, Canada | http://wiki.skullspace.ca/index.php/CryptoParty | Sep 29-01 | Tor at OpenITP Circumvention Tech Summit IV | Berlin, Germany | https://www.openitp.org/openitp/circumvention-tech-summit.html | Sep 30 | Congress on Privacy & Surveillance | Lausanne, Switzerland | http://ic.epfl.ch/privacy-surveillance This issue of Tor Weekly News has been assembled by harmony, Lunar, dope457, Matt Pagan, and Jacob Appelbaum. Want to continue reading TWN? Please help us create this newsletter. We still need more volunteers to watch the Tor community and report important news. Please see the project page [31], write down your name and subscribe to the team mailing list [32] if you want to get involved! [31] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews [32] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0