February 2017 - cypherpunks@lists.ogf.org

[WAR] former Marine sergeant asks the obvious of locals in Iraq, evacuated - YouTube vid CENSORED
by Zenaan Harkness 08 Feb '17

08 Feb '17

Well the vid is not quite censored, but it went from 8 million, to 43 million views, and the original, with its view count, has been removed by Google! (Unless the obvious youtube search of "Steven Gern" and sort by view count, is somehow problematic, but at least it's the presumably obvious.) So here's the (new version?) vid, with only ~19K views, evidently just a few short of 43 million: https://www.youtube.com/watch?v=avLnLnTGtco Here's his evacuation vid (less than 300K views): https://www.youtube.com/watch?v=6ZgcLVK3KB0 On the surface at least, this looks like some serious political interference by Google, with its mission to mould the public political discourse according to its own vision. Zenaan

2 2

[CIVIL WAR] Revolution on the streets only one police-strike away
by Zenaan Harkness 08 Feb '17

08 Feb '17

Be prepared pepes, time's getting closer... Bloodthirsty mob takes over city's streets leaving trail of death and rape after police go on strike http://www.mirror.co.uk/news/world-news/bloodthirsty-mob-leaves-trail-death…

1 0

2nd Amendment petition to USA WH to repeal National Firearms Act of 1934
by Zenaan Harkness 08 Feb '17

08 Feb '17

This one's interesting: " Eliminate the National Firearms Act of 1934 and get our machine guns, suppressors, short barrel shotguns back https://petitions.whitehouse.gov/petition/repeal-nfa " I'd personally vote against recreational nukes, to be sure, but more machine guns could change the American landscape a little ...

1 0

[WAR] Wikileaks: bomb the Muslims, and you are fine; ban the Muslims, and you are the enemy.
by justa 07 Feb '17

07 Feb '17

** The Futile Efforts of Donald Trump http://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413c… ------------------------------------------------------------ by Israel Shamir on Tue, Feb 7, 2017 President Trump had paid a hefty advance to the Jews. He did (almost) all they wanted for their Jewish state: he promised to move the US embassy to the occupied Jerusalem thus legalising their annexation of the holy city; he condoned their illegal settlements, he gave them starred positions in his administration; he told the Palestinians to drop their case in the ICC or else, he even threatened Iran with war. All that in vain. Jewish organisations and Jewish media attack Trump without slightest hesitation and consideration. His first step in curbing the soft invasion wave had been met with uniform Jewish vehemence. Sad - the globalists are winning: ** The Fifth Column Globalists Have Won: Muscovites Banned From Keeping Bears at Home. RIP Russia http://russia-insider.us9.list-manage.com/track/click?u=fa2faf7034c3c3c413c… ------------------------------------------------------------ by Riley Waggaman on Mon, Feb 6, 2017 It's finally happened. Russia's many enemies — foreign and domestic — have successfully conspired to destroy one of Russia's most ancient and holy writs: The right to keep and bear bears. At home. In Moscow. Where your home probably consists of a 2-bedroom apartment. And one of those bedrooms is the kitchen.

1 1

[#AboveMyPayGrade] Protecting quantum computing networks against hacking threats
by Razer 07 Feb '17

07 Feb '17

> Professor Ebrahim Karimi, a member of uOttawa's Department of > Physics and holder of the Canada Research Chair in Structured > Light, and doctoral student Frédéric Bouchard observe the setup > they used to clone the photons that transmit information, called > qudits. Credit: University of Ottawa > > > As we saw during the 2016 US election, protecting traditional computer > systems, which use zeros and ones, from hackers is not a perfect > science. Now consider the complex world of quantum computing, where > bits of information can simultaneously hold multiple states beyond > zero and one, and the potential threats become even trickier to > tackle. Even so, researchers at the University of Ottawa have > uncovered clues that could help administrators protect quantum > computing networks from external attacks. > > "Our team has built the first high-dimensional quantum cloning machine > capable of performing quantum hacking to intercept a secure quantum > message," said University of Ottawa Department of Physics professor > Ebrahim Karimi, who holds the Canada Research Chair in Structured > Light. "Once we were able to analyze the results, we discovered some > very important clues to help protect quantum computing networks > against potential hacking threats." > > Quantum systems were believed to provide perfectly secure data > transmission because until now, attempts to copy the transmitted > information resulted in an altered or deteriorated version of the > original information, thereby defeating the purpose of the initial > hack. Traditional computing allows a hacker to simply copy and paste > information and replicate it exactly, but this doesn't hold true in > the quantum computing world, where attempts to copy quantum > information-or qudits-result in what Karimi refers to as "bad" copies. > Until now. > > For the first time, Professor Karimi's team was able to clone the > photons that transmit information, namely the single carriers of light > known as qubits, as well as quantum theory allows, meaning that the > clones were almost exact replicas of the original information. > However, in addition to undermining what was previously thought to be > a perfect way of securely transmitting information, the researchers' > analyses revealed promising clues into how to protect against such > hacking. > > "What we found was that when larger amounts of quantum information are > encoded on a single photon, the copies will get worse and hacking even > simpler to detect," said Frédéric Bouchard, a University of Ottawa > doctoral student and lead author of an open access publication that > appeared this month in the renowned journal Science Advances. "We were > also able to show that cloning attacks introduce specific, observable > noises in a secure quantum communication channel. Ensuring photons > contain the largest amount of information possible and monitoring > these noises in a secure channel should help strengthen quantum > computing networks against potential hacking threats." > > Karimi and his team hope that their quantum hacking efforts could be > used to study quantum communication systems, or more generally to > study how quantum information travels across quantum computer > networks. To read their paper, visit the Science Advances website. > > More information: High-dimensional quantum cloning and applications to > quantum hacking, Science Advances 03 Feb 2017, DOI: > 10.1126/sciadv.1601915 > > Provided by University of Ottawa https://phys.org/news/2017-02-quantum-networks-hacking-threats.html

2 4

VIDEO: The Role of Tech in the Campaign
by Cecilia Tanaka 07 Feb '17

07 Feb '17

*VIDEO: The Role of Tech in the Campaign* Feb 6, 2017 11:53 PM Joly MacFie <joly(a)punkcast.com> While this session, held at the Knight Foundation and Civic Hall Symposium on Tech, Politics and the Media at the New York Public Library on Jan 18 2017, is not about Women in Tech per se, it does have 4 female tech experts reflecting on how tech worked and didn’t work to serve candidates and voters in 2016. Speakers:: Becky Bond – Bernie Sanders 2016 Campaign Mindy Finn – Vice Presidential Candidate with Evan McMullin Molly Schweickert – Cambridge Analytica / Donald Trump 2016 Campaign Jess Morales Rocketto – Hillary Clinton 2016 Campaign Nancy Scola (moderator) – Politico View on YouTube: youtu.be/y8ypxLXZKq4 ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

1 0

Doxing Nazis: Alt Right’s Anonymity Failing and They Are Unable to Withstand Exposure
by Razer 07 Feb '17

07 Feb '17

[...] "After some prodding on both sides, Bulbasaur and Seventh Son were doxed by their former fans, revealing them to be Van Bryant II and Jesse Craig Dunstan, respectively. While they have discussed the desire to go public for quite some time, the fact that this could have ramifications for their careers is something they could not abide. Enoch, their talkative leader, was a software developer making a six-figure salary in Manhattan, and he took special accommodations to avoid being identified in his personal life while skyrocketing to fame in the white nationalist circuit. Just a few days later people started hearing rumblings that Enoch was about to be revealed after someone traced an article he mentioned on Red Ice Radio to a post on The Mises Institute website from years before, and then used an old PayPal address to find his real name: Mike Peinovich. The internet came apart at the seams at this point as Mike Peinovich was revealed to be one of the most well known white nationalists in the country. He was immediately fired from his job at the tech startup Pronoun, where he was a front-end developer. His family reportedly then disowned him, except for this wife. It was at this point that the Peinovich saga took an even more bizarre turn as it was then revealed that his wife, Ames Friedman, a PR executive in New York, was Jewish. This made the neo-Nazi wing of the Alt Right lose their mind and declare that Enoch was a “Jewish spy,” and Enoch conceded that he had hid this. He went on Rebel Yell to apologize profusely for what he has done, and it was even suggested that he was leaving his wife. It does appear now that they will stay together, though he continues to believe that Jews are subversive agents out to destroy the white race. Without a job and having lost everything, Enoch is vowing to continue to push the Right Stuff and the Daily Shoah forward, though he has been “rent seeking” for money to pay his bills while he waits to start his media empire."[...] Much more https://itsgoingdown.org/alt-rights-anonymity-failing-unable-withstand-expo…

1 0

Chrome 56 Adds Bluetooth Snitch API (will tell you when your fridge needs defrosting)
by Razer 07 Feb '17

07 Feb '17

When Google popped out Chrome 56 at the end of January it was keen to remind us it's making the web safer by flagging non-HTTPS sites. But Google made little effort to publicise another feature that's decidedly less friendly to privacy, because it lets websites ask about users' Bluetooth devices and harvest information from them through the browser. That's more a pitch to developers, as is clear in this YouTube video from Pete LePage of the Chrome Developers team. "Until now, the ability to communicate with Bluetooth devices has been possible only for native apps. With Chrome 56, your Web app can communicate with nearby Bluetooth devices in a private and secure manner, using the Web Bluetooth API," Google shares in the video. "The Web Bluetooth API uses the GATT [Generic Attribute Profile - ed] protocol, which enables your app to connect to devices such as light bulbs, toys, heart-rate monitors, LED displays and more, with just a few lines of JavaScript." In other words, the API lets websites ask your browser "what Bluetooth devices can you see," find out what your fridge, and so on, is capable of, and interact with it. https://www.theregister.co.uk/2017/02/05/chrome_56_quietly_added_bluetooth_… https://yro.slashdot.org/story/17/02/06/1425208/chrome-56-quietly-added-blu…

1 0

Dozens of iOS TLS-enabled Apps Subject to MITM Attacks
by Razer 07 Feb '17

07 Feb '17

While developing a tool for evaluating mobile application security, researchers at Sudo Security Group Inc. found out something unexpected. Seventy-six popular applications in Apple's iOS App Store, they discovered, had implemented encrypted communications with their back-end services in such a way that user information could be intercepted by a man-in-the-middle attack. The applications could be fooled by a forged certificate sent back by a proxy, allowing their Transport Layer Security to be unencrypted and examined as it is passed over the Internet. The discovery was initially the result of bulk analysis done by Sudo's verify.ly, a service that performs bulk static analysis of application binaries from Apple's App Store. Will Strafach, president of Sudo, verified the applications discovered by the system were vulnerable in the lab, using a network proxy configured with its own Secure Socket Layer certificate. In the post about his findings being published today, Strafach wrote: > > During the testing process, I was able to confirm 76 popular iOS > applications allow a silent man-in-the-middle attack to be performed > on connections which should be protected by TLS (HTTPS), allowing > interception and/or manipulation of data in motion. According to > Apptopia estimates, there has been a combined total of more than > 18,000,000 (Eighteen Million) downloads of app versions which are > confirmed to be affected by this vulnerability. > Ars independently verified that several applications discovered by Strafach were vulnerable. These sorts of vulnerabilities are nothing new; thousands of applications have had incorporated bugs that caused TLS to become vulnerable to attack, both on iOS and Android. But the fact that they persist even as Apple tries to push developers toward greater security is disconcerting, to say the least—especially in applications that could expose financial or health data along with user credentials. The data exposed by the vulnerability in each of the applications varied in sensitivity. For just less than half—33 of the applications—the risk was relatively low, as most of the data was "partially sensitive analytics data," Strafach said. These apps included a number of third-party "uploader" apps for Snapchat (which exposed Snapchat usernames and passwords) and the Vice News app, among others. In 24 cases, the exposed data included login credentials or session tokens that would allow an attacker to hijack the account associated with the application, though those accounts were not tied to highly sensitive data. However, the remaining 19 applications left sensitive data exposed to attack. In these cases, Strafach "confirmed ability to intercept financial or medical service login credentials and/or session authentication tokens for logged in users." The names of these apps are not currently being published. "Currently, this list is only available to limited parties due to sensitivity," Strafach wrote. "I have been in touch with MITRE and will follow up later with a listing of the CVE IDs for affected iOS applications of which data interception would be considered medium risk or high risk." The same old story Until recently, many mobile applications didn't protect much of the data sent to their back-end interfaces. When we looked at passive monitoring of mobile applications in 2014, we discovered many applications that were passing session tokens and other sensitive data in the clear. And for some developers that have moved to secure connections, poor verification of TLS certificates has continued to be problem. Even security-focused applications have run into trouble with TLS validation, including the two-factor authentication provider Duo. In 2015, Duo issued a security advisory warning that one version of their iOS application had left open a TLS vulnerability. Many secure applications avoid the issue by using "pinned" certificates hard-coded into applications, which allows them to avoid interception of the certificate hand-shake at the beginning of a TLS session. But that may not be practical for other applications. Apple has been pushing iOS developers to use App Transport Security (ATS) to secure data transmitted by applications sold through the App Store. In December, Apple extended the deadline for application developers to implement ATS. ATS uses TLS v. 1.2 and requires stronger cryptography (AES and SHA-2), as well as "forward secrecy" to protect past transactions if a certificate is compromised. But ATS doesn't ensure that applications properly verify the certificate—just that the developer uses TLS to begin with. ATS does allow for use of Certificate Transparency—a public "log" of verified certificates. Google is also pushing the service and is planning to use Certificate Transparency to enforce validation of trusted web sites by October 2017. But not all certificate authorities (let alone site and app operators) have signed off on implementing CT, so its adoption by app developer is still in its infancy. And if Apple tries to enforce Certificate Transparency now, it could actually cause some applications to become less secure, Strafach said. Developers "would not be able to utilize certificate pinning for their connections, and they could not trust otherwise untrusted certificates which may be required for intranet connections within an enterprise using an in-house PKI." The one ray of sunshine for end-users is that man-in-the-middle attacks (other than those by state actors) are possible only when connected to the Internet via an untrusted Wi-Fi connection. If you're connected using cellular broadband or a trusted wireless network, man-in-the-middle attacks are highly unlikely—though attackers can use Wi-Fi network spoofing to fool a device into connecting to a malicious network, as Ars has demonstrated in the lab in the past. With links: https://arstechnica.com/security/2017/02/dozens-of-popular-ios-apps-vulnera…

1 0

[Access Now] Beware: countering “violent extremism” online risks human rights
by Cecilia Tanaka 07 Feb '17

07 Feb '17

*Beware: countering “violent extremism” online risks human rights.* https://www.accessnow.org/beware-countering-violent-extremism-online-risks-… I will read their guide below a bit later. At first sign, I liked the material very much. It seems pretty reasonable and rational. *ACCESS NOW Position Paper: A Digital Rights Approach To Proposals For Preventing Or Countering Violent Extremism Online.* https://www.accessnow.org/cms/assets/uploads/2016/10/CVE-online-10.27.pdf ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

3 3