April 2015 - cypherpunks@lists.ogf.org

Voting machine hacks
by Douglas Lucas 09 Apr '15

09 Apr '15

As U.S. election approaches...what are your least/favorite examples of hacks of (esp. U.S.) computerized voting systems? You know, technical ones, not propaganda and the idea of democractic voting itself. BlackBoxVoting.org has an interesting collection of PDFs[1] of technical material, including manuals, schematics, and troubleshooting, for various voting system manufacturers, plus reports detailing problems. (There are also the more straightforward non-technical issues, like allowing people to actually watch the vote-counting.) There's also the instance[2] of hackers putting Pac-Man on the Sequoia AVC-Edge DRE voting machine without breaking any of the tamper-evident seals. Finally...in honor of all elections, to use a corporate term: blue-sky thinking. If you were going after (esp. U.S.) computerized voting systems, what would you do? Douglas [1] http://blackboxvoting.org/reports/voting-system-technical-information/ [2] https://jhalderm.com/pacman/

3 3

Vulns of social/freedom initiatives, NSA 0wn3d CPUs, BTC, Infra and Politic
by grarpamp 09 Apr '15

09 Apr '15

https://www.youtube.com/watch?v=H-_KVkQfm-o http://www.reddit.com/r/Bitcoin/comments/31umjo/3m_video_are_intel_processo… http://invisiblethingslab.com/press/itl-press-2009-03.pdf http://theinvisiblethings.blogspot.co.uk/2009/08/vegas-toys-part-i-ring-3-t… https://www.youtube.com/watch?v=FHFSvttMg6E http://www.iamsatoshi.com/ https://www.youtube.com/user/IamSatoshiNakamoto http://vinay.howtolivewiki.com/blog/ http://re.silience.com/

2 1

Re: cypherpunks Digest, Vol 22, Issue 6
by tigrutigru＠gmail.com 08 Apr '15

08 Apr '15

Loosely related to Mike Ingle's mention of Twister and Bitmessage - made me think of Secure Scuttlebutt https://github.com/ssbc/phoenix based on gossip protocol. Sent from my iPhone > On 6 Apr 2015, at 7:02 am, cypherpunks-request(a)cpunks.org wrote: > > Send cypherpunks mailing list submissions to > cypherpunks(a)cpunks.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://cpunks.org/mailman/listinfo/cypherpunks > or, via email, send a message with subject or body 'help' to > cypherpunks-request(a)cpunks.org > > You can reach the person managing the list at > cypherpunks-owner(a)cpunks.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of cypherpunks digest..." > > > Today's Topics: > > 1. Re: Dollar Value of a Datamined "Free" Service User? (rysiek) > 2. Re: Dollar Value of a Datamined "Free" Service User? (grarpamp) > 3. Re: Dollar Value of a Datamined "Free" Service User? (grarpamp) > 4. Re: Dollar Value of a Datamined "Free" Service User? (rysiek) > 5. Re: Warrant Canaries (grarpamp) > 6. Forward secrecy implemented, was Re: How to have your > encrypted mail in two places at once (Mike Ingle) > 7. Re: Greenwald, Scahill step down from The Intercept (Mirimir) > 8. Re: Greenwald, Scahill step down from The Intercept (Juan) > 9. Re: Greenwald, Scahill step down from The Intercept (Cari Machet) > 10. Fwd: The West's Shame (Александр) > 11. Re: The West's Shame (Zenaan Harkness) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 05 Apr 2015 18:14:31 +0200 > From: rysiek <rysiek(a)hackerspace.pl> > To: cypherpunks(a)cpunks.org, cypherpunks(a)cpunks.org > Subject: Re: Dollar Value of a Datamined "Free" Service User? > Message-ID: <2015159.YdJg2uZ1UC@lapuntu> > Content-Type: text/plain; charset="utf-8" > > Dnia wtorek, 24 lutego 2015 23:51:52 grarpamp pisze: >> (...) >> Anyone have links to studies made within the last five years that >> have attempted to calculate the dollar value of datamined users? > > Have a look around here: > http://www.inrialpes.fr/planete/people/lukasz/ > > -- > Pozdrawiam, > Michał "rysiek" Woźniak > > Zmieniam klucz GPG :: http://rys.io/pl/147 > GPG Key Transition :: http://rys.io/en/147 >

1 0

Re: Greenwald, Scahill step down from The Intercept
by John Young 08 Apr '15

08 Apr '15

>my problem with laura as with jeremy is that they are too >capitalistic and therein breech ethics That's the crucial fault of the Snowden campaign, its corrupt core, ambition and greed triumphant. Snowden is paying the high price for others' profit. A nadir in contemporary journalism seemingly without bottom. Meanwhile obsessive handwringing about petty story fabrication, as if to avoid the principal fabrication of 2013-2015, instead praising, awarding, investing, promoting, recycling, gaming, streaming, TEDing, Oscaring, glorifying, comedifying it.

6 15

Massive License Plate Databases
by grarpamp 08 Apr '15

08 Apr '15

https://cdt.org/blog/government-keeps-its-eyes-on-the-road-with-invasive-li… On April 2, the Department of Homeland Security (DHS) released a Privacy Impact Assessment (PIA) that describes how the DHS Immigration and Customs Enforcement (ICE) – including ICE’s primary investigative offices, Enforcement and Removal Operations and Homeland Security Investigations – will find the present and past location of drivers by accessing a massive private database of vehicle location information. The program raises serious privacy concerns, with the specter of individuals’ location data being collected on a mass scale, stored for a prolonged period, and used without effective restrictions. According to the PIA, both fixed and mobile license plate readers record license plate number, a digital image of the license plate, the vehicle’s make, model, and state of registration, GPS location, a time stamp, and sometimes “the environment surrounding a vehicle, which may include drivers and passengers.” A private company – probably Vigilant Solutions, which has amassed of database of 2.5 billion license plate location records, will hold the data. ICE can then use license plate numbers to query a database, and provide a “hot list” of license plate numbers under surveillance to the private company so that when there is a hit on one of those numbers, ICE will receive immediate notice of the location of the license plate. Queries can uncover all recorded sightings of a license plate for the previous five years, or as far back as the statute of limitations for the crime being investigated. ......

1 0

Dollar Value of a Datamined "Free" Service User?
by grarpamp 08 Apr '15

08 Apr '15

Many companies do not charge users of their services. They say things like "It's free and always will be." Pick any "free" service... Facebook, Google, Yahoo, Match, Reddit, the list goes on and on. Only the smallest of free services can be supported by someone's personal funds. So for larger services it's well understood that if their users aren't paying them, the money must come from somewhere. The old model answer of former years was advertising through page ads, clickstreams, referrals and those sorts of obvious and observable things. Combined with burning off stock market offerings. The new model answer includes all the former ways, plus much deeper profiling and analysis of users, their pictures, messages, interests, locations, etc... all done on the secret unobservable corporate backend, and selling off that metadata to the highest bidders. And perhaps more dollars from simply lying, violating their publicly posted hole ridden privacy policies, and selling directly identifiable user data as well. Or say taking immunity from prosecution from having given/sold it away to cozy governments. All of which have monetary values associated with them. Companies also hide their revenue, costs, and their "active in last three months" vs "dead user" numbers. Some usable public statements and government/market filings are available. And datacenter and employee costs can be approximated. There is current value analysis, such as in selling what's hot by this months clicks. And future/lifetime value analysis, such as Target datamining for pregnant women to own. There are also dataset specific values, such as names and addresses vs political alignments. The values could be represented in $dollars per month per user. Anyway, question... Anyone have links to studies made within the last five years that have attempted to calculate the dollar value of datamined users?

4 8

HavenCo - Rebirth?
by grarpamp 07 Apr '15

07 Apr '15

Highly doubt Ryan, Avi or any cpunks are involved, or that much of anything will actually be in SeaLand. Seems like a news driven oppurtunistic biz to cover tower operation and maintenance costs. Anyone have any facts? Such as who's behind it and why? http://www.sealandgov.org/sealand-news-1/HavenCo http://www.havenco.com/

2 1

The Government Can Perv My Junk... WTF!!!
by grarpamp 07 Apr '15

07 Apr '15

https://www.youtube.com/watch?v=XEVlyP4_11M There are very few government checks on what America’s sweeping surveillance programs are capable of doing. John Oliver sits down with Edward Snowden to discuss the NSA, the balance between privacy and security, and dick-pics. http://www.thoughtcrime.org/blog/we-should-all-have-something-to-hide/

2 1

Nothing drives adoption of free software better than a good ole crackdown
by Seth 07 Apr '15

07 Apr '15

This is a case study of why I welcome crackdowns on online freedom and corporate silo censorship; it's highly effective in getting people off their ass and drives them into the warm and loving arms of free software and crypto. reposted from the Free Software Foundation newsletter ----------------------------------------------------- This guest post was submitted by Daniel Dianes, a Spanish free software activist. A Spanish language version of the post is coming soon. The cancellation or temporary suspension of various Spanish Twitter accounts has led to a huge migration of Spaniards to GNU social, a microblogging service designed to foster user freedom and control. This is an exciting win for federated online services. Unlike Twitter, which is controlled by a centralized authority, GNU social is a network of independent servers called nodes. Federation technology allows users to communicate between nodes, preserving the unified experience of traditional social media systems, and the free GNU social software allows anybody with an Internet connection to start their own public or private node and join the network. These administrators can even customize their nodes to suit the unique needs of their users. Since GNU social is decentralized, it's harder for a company or government to censor content or shut down the network when they feel threatened by it. This is more than a hypothetical threat—it has been attempted multiple times by oppressive governments. Spreading out user data also makes bulk surveillance considerably more difficult, as there is no single database to crack into and copy. Twitter user @Barbijaputa is popular in Spain, with more than 167,000 followers. She's known for criticizing the government or any other political parties or groups of power. On January 14th, Twitter suspended @Barbijaputa's account after she participated in a conversation about sexually transmitted diseases. The next day, she created a profile on GNU social node Quitter.se and started posting. Her Twitter followers proved willing to follow her all the way to GNU social, and began joining existing nodes en masse and starting their own. The growth was so explosive that the some of the existing GNU social nodes were unable to handle the traffic. On January 15th, a Quitter administrator posted this note: "Due to high traffic, I need to stop the registrations for some time to get back in control. Has been a crazy day (15.01.15) on quitter.no and .is - -regards @knuthollund" The node Quitter.es (Quitter Spain) was created to handle some of the extra people that overloaded existing GNU social instances like Quitter.no and Quitter.is. Quitter Spain now has 6,667 users and counting and Quitter.se reports 4,982 users, due in part to the incoming Spanish users. GNU social is not the only federated social network challenging the centralized status quo. GNU MediaGoblin lets users publish images, videos, 3D models, and other files, Diaspora* provides a Facebook-like experience and pump.io is another option for microblogging. The Free Software Foundation runs a GNU social node at https://status.fsf.org. Get started with GNU social today by picking from this list of nodes, and follow the Free Software Foundation at @fsf. Or try pump.io, and follow the FSF account @fsf there. Even if you don't have as many followers as @Barbijaputa, encourage them to follow you! Daniel Dianes, FSF member #9171 Read online: https://www.fsf.org/blogs/community/thousands-of-spaniards-leave-twitter-fo…

1 0

re: A crowdfunding campaign to build a free baseband
by wirelesswarrior＠Safe-mail.net 07 Apr '15

07 Apr '15

SF, Although creating an open GSM mobile modem is an interesting technical exercise it seems to make sense ONLY if there are secure mobile networks within which to operate. Although someday that might happen alas this not even close to being the case (there are several OS SDR projects for base station/network infrastructure creation). All standardized mobile networks were created with significant influence from intel agencies and even if OS SDR networks were deployed they could not be made secure if they integrated with the S7 backbone/interchange of the current networks. Even if your project manages to yield the result desired it will still be stuck in the "matrix". A much simpler, more secure and generally useful mobile system might result from mobile devices with hardended kernals/OS' using only WiFi in conjunction with good wireless hygine to prevent data leakage, a variety of available technologies to enable secure end-to-end voice and data communications. Secure paging, to alert users who's devices are not currently connected, should even be possible by adding a RTL receiver dongle and using appropriate tradecraft with existing pager networks (yes, they still exist and are used heavily by professionals (including sex workers), government and even devices calling for repair). WW PS: Suggest you enable lower contribution steps for crowd funding. They are too high for many who might like to help but cannot afford or justify the current steps.

1 0