December 2017 - cypherpunks@lists.ogf.org

[Free E-Book] Essays on Bitcoin
by Cecilia Tanaka 28 Dec '17

28 Dec '17

https://www.essaysonbitcoin.com Well, being sincere, I didn't read it yet. Sorry, received the references of this book only a few minutes ago... :P Good night kisses and sweet dreams, dear all. <3 c. ---------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

2 1

Current State of Mailing Lists / Forums about Internet Freedom, Security and Privacy?
by BM-2cXCAVedtJwvdVXg9HeMPZp8k5UAakzTMs＠bitmessage.ch 28 Dec '17

28 Dec '17

Hello. I was originally writing this post for tor-talk mailing list, which is a general mailing list hosted by Tor Project to discuss online anonymity and cryptography technology, I later realized it was probably a good idea to seek feedback from other lists so I crossposted it to many of them. It's all my humble options and please forgive if it's inappropriate. In the history of the Internet, there were always some communities who found themselves (or placed themselves) in the center of the storm on cutting edge development related to Internet freedom, security and privacy in the past 30 years. Back in the 80s, sci.crypto and a handful of newsgroups were prominent and widely read by everyone in the field of security and cryptography. In the 90s, there were comp.risks and the Cypherpunk mailing list, and they are probably everything you need for resources and discussions. In 2000s, Bugtraq and the Full Disclosure movement started, where all the security holes were debated and exposed. Those communities were center of the mass, brought all the talent people together, to conduct free discussions and research about everything ongoing in the field, no matter it was news, debate, designs, programs, rumors or personal argument, with light or no moderation, where ideas crashed on each other and produced fruitful new approaches. Unfortunately, it looks like that this kind of communities is becoming endangered species. It's hard to find anything similar after 2008 (or ~2005)? All the existing lists are dead pools now with few threads, some newsgroups still exist, but are toxic now since only narcissists are posting, and no other existent members to stop them since, they were all gone. The remaining lists are becoming project-centric, only discuss specific technical issues and not a general platform of discussion, such as this tor-talk (historically, mailing lists named as "-talk" were usually popular, like a party). seclists.org still has some historically famous lists but they are not very active, comp.risks only has news digest now! No posters! The Cryptography mailing list on metzdowd.com is still moving, but only 3 or 4 topics are discussed monthly (but in-depth, which is good), with strict on-topic policy. Other popular forums, like HackerNews or Reddit, functions more like a brief digest instead of a general purpose online forum. Where are all the hackers, developers, cryptographers, activists, researchers, etc gone? 1. It seems that the arise of social media, like Facebook and especially Twitter, is partially responsible for the current state of deterioration of online forums, as now all the latest and interesting information are tweets, and everyone's on Twitter. They are turning the Internet communities to be less and less formal and sophisticated people, Have a new project? Instead of writing a 1000 words short essay and debating with all the experts in the mailing list, just send a 50-word tweet and post the code to GitHub! 2. It seems that the scope of Internet freedom, security and privacy has expanded infinitely, it's infeasible to talk to everyone on Earth in this field by posting in two or three mailing lists, everyone moved to their personal (physical and online) social network to talk is a natural result of it. This is how the Cypherpunk list dead according to some, I believe the same thing is going on everywhere. (sorry if Cypherpunks found it's offensive, no intention to insult, but just no longer the center of mass according to John Gilmore in 2002). 3. It seems that the Internet is no longer an academic thing and compared to popular culture online, the research community becomes almost invisible and finally led to the collapse of many of them. 4. It seems that the Internet is no longer an utopian "cyberspace", but now with lots of threats, such as doxxing and mass surveillance. 20 years ago it's normal for a hacker or activist to post a controversial research, with the phone number and personal address attached in a mailing list, and joining monthly offline meetings. But now, many of them, or perhaps even you, the one who is reading this post, would prefer a low profile in the community, or proactively separate different works. Many are also prefer a private Off-the-record talk over a public debate, prefer small private groups with encryption over big open space. Some even proactively obscure or erase online records. This has two consequences, first, the Big Brother has to work harder and it's good. But it also means the community as a whore becomes harder to communicate with each other, there are always time when someone discovered something which is unnoticed to others, or comes up with an exceptionally good idea. But a fragmented community is more difficult to promote them. (It's also difficult to conduct a historical research in the future, which can be a problem. In contrast the Usenet posts from the 80s are still here and it's good for history and research, but bad for privacy, but it's another topic). Look! Number 1, 2, 3, 4 actually goes together, towards the same end! Does anyone have an option about how the things going on today? Any explanations of the current state of the Internet communities? And what is your recommendation of a good online fourm for general discussion of freedom, security and privacy? Cheers, John Random

5 5

Re: [Cryptography] Bitcoin theft and the future of cryptocurrencies
by grarpamp 28 Dec '17

28 Dec '17

On Wed, Dec 27, 2017 at 4:28 PM, Howard Chu <hyc(a)symas.com> wrote: > The paper's author has no connection to any particular coin > project. Didn't say they were connected. The btcmanager article's author is though by disclaimer... "The author owns monero but does not own any zcash." Rephrasing what that prefixed... Is it *possible* to use whichever coin in a way such that an analysis paper against it becomes mitigated / moot? If no, then add the paper to the stack of breaks, and documented design inapplicabilities / oversights / cantfixes / wontfixes and so on, that will weigh upon its validity as a coin, and choices made as to its use cases. "Goes to zero" breaks are obviously included in this. If yes, then simply bashing the coin as broken, is crap rhetoric, when the issue may really be better usage, documentation, knowledge, and design therein so that such footshooting is harder or more obvious. Given the usage caveats and potential mitigations noted in the below, perhaps this is really a case of the latter yes condition. https://z.cash/blog/transaction-linkability.html http://jeffq.com/blog/on-the-linkability-of-zcash-transactions/ http://arxiv.org/pdf/1712.01210.pdf http://jeffq.com/zcash-rtts.htm https://z.cash/blog/new-research-on-shielded-ecosystem.html https://btcmanager.com/linkability-zcash-transactions-study-precipitates-de… A Traceability Analysis of Monero’s Blockchain https://eprint.iacr.org/2017/338.pdf In sum, all the purported privacy coins have years of analysis and improvements to go before the word private can truly be considered to apply to any of them. Further, it may be that newer privacy tech and privacy coins will surpass any that exist today. Communities getting embattled aren't productive way to address design / tech, accept obsolescense, and improve with new. Change is part of the nature of cryptocurrencies. The old rules of fiat should not be expected to apply. There will *never* be one coin to rule them all, but many happy families. And every one will be far different than whatever random stack of fiat notes might fill the purse of a globetrotter. Ps: DPRK, China, "criminals", etc supposedly print US money in bulk just like the US itself does... interesting to compare that to potential outcomes of any compromised ceremonies, inadequate coin architectures, early heights of flawed blockchains still affecting their own subsequent fixes and so on...

1 0

Re: [Cryptography] Zcash 2nd Ceremony Call for Review / Participation, @Snowden EFF ACLU Privacy Updates
by grarpamp 27 Dec '17

27 Dec '17

> What specifically are you claiming was incorrect about my writeup? No claims, just noting that news outlets, competing coins, etc often cite / claim posts on the internet as saying this or that or whatever, when oftentimes a more detailed reading of the posts alongside their cite / claim shows their error. "Zcash 2nd Ceremony Call for Review / Participation" Because... if Z / privacy tech (or any coin tech) is to become more trusted and used in multitude of applications, or even just for $B's to $T's worth of simple monetary holdings and flow, wide review of the crypto and so on is part of that. The necessity of critical writeups where due (by many people) along the way should be obvious. Linking the easier to read unstriked version for those reviewing or working coins, now and in the future, such that anything noted therein might be considered in that process... https://web.archive.org/web/20171010030051/https://petertodd.org/2016/cyphe… And some links collated from it... https://moderncrypto.org/mail-archive/curves/2016/000742.html http://www.weboftrust.info/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.iana.org/dnssec/ceremonies

1 0

[dave@horsfall.org: [TUHS] Happy birthday, Charles Babbage!]
by John Newman 27 Dec '17

27 Dec '17

Interesting - I didn't know Babbage dabbled in crypto.. Apparently the "Vigenere Cipher" was considered unbreakable for ~3 centuries, although Babbage and others broke it and variants of it at various times up to and in the 19th century... https://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher ----- Forwarded message from Dave Horsfall <dave(a)horsfall.org> ----- Date: Tue, 26 Dec 2017 10:58:47 +1100 (EST) From: Dave Horsfall <dave(a)horsfall.org> To: The Eunuchs Hysterical Society <tuhs(a)tuhs.org> Subject: [TUHS] Happy birthday, Charles Babbage! User-Agent: Alpine 2.21 (BSF 202 2017-01-01) Charles Babbage KH FRS was born on this day in 1791; pretty much the father of the computer, a model of his "difference engine" built to the standards of the day worked, complete with its printer. What is not so well known about him was that he dabbled in cryptography, and broke the Vigenère cipher; unfortunately for him it was classified as a military secret, so one Friedrich Kasiski got the credit instead. -- Dave Horsfall DTM (VK2KFU) "Those who don't understand security will suffer." ----- End forwarded message ----- -- GPG fingerprint: 17FD 615A D20D AFE8 B3E4 C9D2 E324 20BE D47A 78C7

3 5

Re: [WAR] - Re: (53) Gaddafi's Prophecy, 2011 - "Europe will turn black" - YouTube
by Zenaan Harkness 26 Dec '17

26 Dec '17

On Tue, Dec 26, 2017 at 01:28:51PM -0500, Ric Moore wrote: > On 12/26/2017 04:04 AM, Zenaan Harkness wrote: > > > Gaddafi nationalised the oil producing industry. > > He promised that the huge profits would be fairly distributed across > > the entire country. > > All Libyans began to receive their share of the Libyan oil trade. > > > > "When the people can see that a certain leader is raising the > > standard of living, of course he will have a lot of support." > > > Gaddafi committed the one sin that could not be abided. He proposed to put Libya's currency to a gold standard, and > further planned to accept gold only as payment for their oil exports. The Hillary Mafia smelled blood in the water. He > had to die. > https://www.youtube.com/watch?v=6DXDU48RHLU Indeed.

1 0

Re: [Cryptography] Bitcoin theft and the future of cryptocurrencies
by grarpamp 26 Dec '17

26 Dec '17

> https://www.reddit.com/r/DarkNetMarkets/comments/5cb74u/blockchain_analysis… > > (Unfortunately the original text of the above post has been deleted. I've > been looking for an archived copy but haven't found one yet. Suffice to say, > it showed that as of 2016 law enforcement already had off-the-shelf software > capable of deanonymizing coinjoin'd transactions.) Nothing really new here that wasn't understood by blockchain tech community in early days... ========== https://www.reddit.com/r/DarkNetMarkets/comments/5cb74u/blockchain_analysis… Blockchain Analysis and Anti-Money Laundering (X-post from /r/DarknetmarketsOz) submitted 20161110T233518 by Realitybytes_ http://archive.is/zLPcs As promised many months ago, I have attended my first CP session on AML/CTF for cryptocurrency and I am now in a position to discuss at a high level what the current state of play is. While AML issues have not been touched on in this course yet (strategies and counter strategies will be discussed in session 2), I felt some of these issues are too important to wait for a better write up post this time and the overall method they are using to undertake AML analysis is now exceptionally clear. I note some of the technology demonstrated to us in these sessions is very new (been in use for less than 90 days) and from what we are being shown, it's powerful enough that some significant steps may need to be taken in the future to avoid being tagged, I will address this after outlining what is being demonstrated to us. ──────── The current state of play Not much surprise too many of you who are concerned with significant opsec, however banks have been indiscriminately flagging every transaction related to bitcoin purchases and sales for quite some time, I even raised in this my previous post on AML/CTF. When I raised this previously, I assumed it was just regular AML/CFT controls, however I was wrong, this information has been used in a project I was not privy too, and this data from the banks I have worked with (in Australia) has been consolidated with many banks within the 5 eyes and provided to a data science corporate (Palantir) to conduct large scale inference matching alongside the distributed ledger. >From what was demonstrated, this software basically matches up all transactions that show funds being flowed into the block chain (via banks, credit cards and KYC/verified website sites) and matches this information up to begin building out a map of who wallets relate to. The software is currently being developed to undertake profile matching (albeit this is only in a preliminary stage) so if you have sent funds to the same wallet from a different wallet, it will link them to the owner again (this is still inherently inaccurate). ──────── What this means for buyers The systems in place seem heavily predecated around buyers not vendors which I found surprising, with the early reports showing that in as few as 2 transactions matched between the block chain distributed ledger and bank accounts de-anonymising wallets which is undertaken using information relating to a weight price of bitcoin (with tolerances) and the tracking of the specific value of bitcoins being sent, due to the finite nature of bitcoin transactions flowing from bank accounts to wallets this is already being tracked in real time. >From our conversations (and inherent alarm of this in the audience, leading to the conclusion there are plenty of my peers buying from markets) as far as we have ascertained, this data is not yet being used for any purpose aside from mass de-anonymising users, which leads my peers and me to believe that the movement of funds alone cannot be used for raising charges, this does raise other concerns at an administrative level, as it is likely this data could be shared between government bodies to authorise a "probable cause" warrant on mail and houses. I can also confirm that this software was used in the most recent police sting in New Zealand, adding weight to the conclusion that judges are comfortable signing warrants on this information. If you have always undertaken cash purchases of LBC, avoided KYC requirements and never cashed out bitcoins, you are likely still anonymous. ──────── What this means for vendors As detailed above, as the software undertakes bank and transaction matching to wallets as long as they have never directly cashed out money from a wallet to their bank, they should still be safe. This section will likely be expanded on post session two when we address AML concerns. ──────── Tumblers are useless Against my better judgement, I’m going with this click bait heading, but the premise is correct. Due to the software running real time analysis on the ledger, simply avoiding taint and breaking up coins is now entirely ineffective, as it matches the full bitcoin amount to be received over a period of time, as the software is built around a neural net of sorts (talking out of school here, I’m not a programmer) it appears to self-correct in real time as a more "likely" or "accurate" owner conclusion is reached. ──────── Frequently asked questions These are the questions asked in the audience and their response (not mine; I have no opinion either way). How quickly can it de- anonymise a user? If the user has sent coins from a KYC verified organisation, the wallets sent through will be de-anonymised in real time, otherwise it will assign a unique primary key to the wallet once it has been identified as unique and it will flag all wallets believe to be owned by this user. Who is this data currently being shared with? The information is available to all major international anti-crime organisations; however at this time the analysis has been undertaken for Australia, New Zealand, America, Canada and the United Kingdom. How will this impact other cryptocurrencies? The overall process it determined to be identical, if there is a block chain to be analysed and a trade of cash to these coins it is anticipated we will continue to de-anonymise wallets. How will this to used to combat the drug trade? The software will inherently flag dealer wallets in the same process it flags purchasers; however as the overall end result between buyers and sellers is the opposite this information will be used to assist law enforcement to identify volume of sales based on turnover. - Are we legally allowed to utilise this information? As cryptocurrencies are determined to be an asset not a currency, the existing laws allow this to be monitored similar to that of any asset. What about monero? We believe due to the low adoption rate difficult in obtaining coins and converting into cash that monero adoption will continue to be low, similar to that of any alternative cryptocurrency. ──────── What measures should now become the default Under no circumstance should you be purchasing bitcoins from any KYC verified organisation, and banks should be avoided. Purchasing in cash is now the default. - Wallets should be changed regularly, at a "on a per transaction" basis is possible. Everyone should send bitcoins in rounded amounts from 0.25 to 1.0, this would destroy the entire matching algorithm, if we all just send coins in amounts of 1.0 it would be impossible to ascertain users if we avoided KYC. - All bitcoin movements should be undertaken via a non-domestic VPN or TOR ──────── Apologies if this article seems like a doom and gloom speech, I am actually surprised as to how well developed this process is. I got to play with the software for a few minutes and I was surprised to see it new I purchased bitcoins and what my wallet was (fortunately for me, there was no solid line to a market). If you have any questions, please let me know, I will do another follow up post my session two, however this is booked in for February, so in the meantime stay safe and stay anonymous. ==========

4 3

[from offlist] Re: Juan-fap go bye-bye now...
by Ashkenazi 26 Dec '17

26 Dec '17

> Razer g2s at riseup.net > Thu Aug 31 10:58:06 PDT 2017 > > you can't show me any 'scripture' > Talmud: archive.org/details/TheBabylonianTalmudcompleteSoncinoEnglishTranslation TL;DR: 8ch.net/pol/res/10455342.html Though Juan might prefer: 8ch.net/islam/ > I KNOW YOU'RE IGNORANT > Because Rr is a fascist authoritarian who has decided for all of us what is known. > "Old Testament" is christchan > Lol. The first five books are from the Jewish Torah. I know you are not religious but fuck, you should know at least this. 8ch.net/pol/res/10511347.html > I'm not interested in arguing > Only asserting your beliefs as truths. This is not our way.

3 3

HookTube
by Cecilia Tanaka 26 Dec '17

26 Dec '17

Hey, cute guys and girls! Did someone here already try to use the HookTube? Is really trustful or too good for being real? Should I run away shouting hysterically "It's a trap!!!"? Hahaha!!! ;D ========== # https://hooktube.com <https://hooktube.com/> "Share YouTube videos without giving them views. Bypass country blocks and age restrictions. Download YouTube videos and music. View quarantined videos as they appeared before YouTube Heroes got to them. Keep your data private from the G. HOW: Just replace the domain in any YT link with hooktube.comand you get a light-weight page that loads YouTube's media files (mp4, webm, etc) directly into your browser's native media player. https://youtube.com/watch?v=S6bOkFLrsAc becomes https://hooktube.com/watch?v=S6bOkFLrsAc, etc. Supported parameters: start, end, loop (1 for on), speed (range: 0.01 to 4), autoplay (0 for off, default is 1)." ========== Thank you in advance for any tip or opinion, public or private, dear all! :D Tender kisses and tight hugs, in special to Ilsa and Marina! I am very proud of your inner strength, girls! Take care, everybody! <3 Ceci, still depressed, but f_cking curious as always, haha!! :D ---------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

1 0

Current State of Mailing Lists / Forums about Internet Freedom, Security and Privacy?
by BM-2cXCAVedtJwvdVXg9HeMPZp8k5UAakzTMs＠bitmessage.ch 26 Dec '17

26 Dec '17

Hello. I was originally writing this post for tor-talk mailing list, which is a general mailing list hosted by Tor Project to discuss online anonymity and cryptography technology, I later realized it was probably a good idea to seek feedback from other lists so I crossposted it to many of them. It's all my humble options and please forgive if it's inappropriate. In the history of the Internet, there were always some communities who found themselves (or placed themselves) in the center of the storm on cutting edge development related to Internet freedom, security and privacy in the past 30 years. Back in the 80s, sci.crypto and a handful of newsgroups were prominent and widely read by everyone in the field of security and cryptography. In the 90s, there were comp.risks and the Cypherpunk mailing list, and they are probably everything you need for resources and discussions. In 2000s, Bugtraq and the Full Disclosure movement started, where all the security holes were debated and exposed. Those communities were center of the mass, brought all the talent people together, to conduct free discussions and research about everything ongoing in the field, no matter it was news, debate, designs, programs, rumors or personal argument, with light or no moderation, where ideas crashed on each other and produced fruitful new approaches. Unfortunately, it looks like that this kind of communities is becoming endangered species. It's hard to find anything similar after 2008 (or ~2005)? All the existing lists are dead pools now with few threads, some newsgroups still exist, but are toxic now since only narcissists are posting, and no other existent members to stop them since, they were all gone. The remaining lists are becoming project-centric, only discuss specific technical issues and not a general platform of discussion, such as this tor-talk (historically, mailing lists named as "-talk" were usually popular, like a party). seclists.org still has some historically famous lists but they are not very active, comp.risks only has news digest now! No posters! The Cryptography mailing list on metzdowd.com is still moving, but only 3 or 4 topics are discussed monthly (but in-depth, which is good), with strict on-topic policy. Other popular forums, like HackerNews or Reddit, functions more like a brief digest instead of a general purpose online forum. Where are all the hackers, developers, cryptographers, activists, researchers, etc gone? 1. It seems that the arise of social media, like Facebook and especially Twitter, is partially responsible for the current state of deterioration of online forums, as now all the latest and interesting information are tweets, and everyone's on Twitter. They are turning the Internet communities to be less and less formal and sophisticated people, Have a new project? Instead of writing a 1000 words short essay and debating with all the experts in the mailing list, just send a 50-word tweet and post the code to GitHub! 2. It seems that the scope of Internet freedom, security and privacy has expanded infinitely, it's infeasible to talk to everyone on Earth in this field by posting in two or three mailing lists, everyone moved to their personal (physical and online) social network to talk is a natural result of it. This is how the Cypherpunk list dead according to some, I believe the same thing is going on everywhere. (sorry if Cypherpunks found it's offensive, no intention to insult, but just no longer the center of mass according to John Gilmore in 2002). 3. It seems that the Internet is no longer an academic thing and compared to popular culture online, the research community becomes almost invisible and finally led to the collapse of many of them. 4. It seems that the Internet is no longer an utopian "cyberspace", but now with lots of threats, such as doxxing and mass surveillance. 20 years ago it's normal for a hacker or activist to post a controversial research, with the phone number and personal address attached in a mailing list, and joining monthly offline meetings. But now, many of them, or perhaps even you, the one who is reading this post, would prefer a low profile in the community, or proactively separate different works. Many are also prefer a private Off-the-record talk over a public debate, prefer small private groups with encryption over big open space. Some even proactively obscure or erase online records. This has two consequences, first, the Big Brother has to work harder and it's good. But it also means the community as a whore becomes harder to communicate with each other, there are always time when someone discovered something which is unnoticed to others, or comes up with an exceptionally good idea. But a fragmented community is more difficult to promote them. (It's also difficult to conduct a historical research in the future, which can be a problem. In contrast the Usenet posts from the 80s are still here and it's good for history and research, but bad for privacy, but it's another topic). Look! Number 1, 2, 3, 4 actually goes together, towards the same end! Does anyone have an option about how the things going on today? Any explanations of the current state of the Internet communities? And what is your recommendation of a good online fourm for general discussion of freedom, security and privacy? Cheers, John Random

2 1