March 2017 - cypherpunks@lists.ogf.org

In ECDSA, without knowing priv. key and any signature one can sign random garbage
by Georgi Guninski 06 Mar '17

06 Mar '17

In ECDSA, the signature of number H is pair (r,s). Without knowing the private key and any signature made with the key, one can sign: 1. "random garbage" (there is some complicated structure in it) 2. H=0 3. H=r 4. H=s Is this known and/or trivial? Attached are some Sage example for bitcoin's curve SEC256k1. Would someone confirm or deny the examples with X=111 and unknown private key indeed work? Taking challenges: give the public key Q_A=(x,y) on the curve.

1 0

Is the revolution over?
by \0xDynamite 05 Mar '17

05 Mar '17

Honestly, I'm back to this list shell-shocked. I left this civilization, thinking things were on track, but coming back, I see the information revolution has turned into another glam and sham celebration. What happened to John Perry Barlow? What's the value of cryptography if everyone's content with facebook, jabbascript login portals, and the same old commerce now 100 times easier? Are there any revolutionaries? Is the soul for real change dead? Is everyone medicated, over-eaten, touch-screen hyper-media and everyone is PERFECTLY CONTENT? I still have a complete revolution in my pocket, but I guess I'll have to chuck it, if there's no one here... Marcos

5 6

New industry? Cocaine harvesting: Salmon caught near Seattle proven to be inundated with antidepressants, cocaine and more
by Zenaan Harkness 05 Mar '17

05 Mar '17

Salmon caught near Seattle proven to be inundated with antidepressants, cocaine and more http://www.naturalnews.com/053163_salmon_Puget_Sound_drug_contamination.html

1 0

eBook (pdf) Cities Under Siege: The New Military Urbanism - Libcom
by Razer 05 Mar '17

05 Mar '17

A "Psychogeographical look at the ever increasing encroachment of militarism and high tech surveillance into urban areas." "Cities Under Siege comprises three broad, thematic chapters, followed by seven extended case studies. The first of the thematic chapters looks at how warfare, political violence and military and security imaginaries are now re-entering cities. This development follows a long period when Western military thought was preoccupied with planning globe-straddling nuclear exchanges between superpowers or massed tank engagements across rural plains. It examines, too, the ways in which the latest military and security doctrine is working to colonize the everyday environments of modern conurbations. Chapter 2 moves on to look at how the various bastions of the political right increasingly work to demonize cities as intrinsically threatening or problematic places necessitating political violence, militarized control, or radical securitization. In Chapter 3, I detail the particular characteristics of the new military urbanism, and use some of the latest research in the social sciences to highlight key features of the deep ening crossover between urbanism and militarism. The next six case studies address the circuits through which the new military urbanism connects urban life in the West to existence on colonial frontiers. The first three look at, respectively, the proliferation of borders and surveillance systems within the fabric of urban life; the US military's ambitions for urban and counterinsurgency warfare based on the deployment of armed robots; and the connections between entertainment, simulation and US military and imperial violence. The final three explore the diffusion of Israeli technology and doctrine in urban warfare and securitization; the links between urban infrastructure and contemporary political violence; and the ways in which Sports Utility Vehicle (SUV) culture is embedded within a geopolitical and political- economic setting that links domestic and colonial cities and spaces. https://libcom.org/library/cities-under-siege-new-urban-militarism-stephen-… Direct link, PDF, 7.3Mb: https://libcom.org/files/Graham,%20Stephen%20-%20Cities%20Under%20Siege.%20…

2 1

[RUS] Communist Party leader Zyuganov names the Zionist Jews
by Zenaan Harkness 05 Mar '17

05 Mar '17

In an open letter, Communist Party leader Gennady Zyuganov claimed there is a Zionist conspiracy to seize power in Russia and asserted that “Zionist capital” has wrecked Russia’s economy. The letter appeared to be aimed at the Russian business tycoons known as the “oligarchs,” who were instrumental in reelecting President Boris Yeltsin over Zyuganov in 1996. Most of these business people are Jewish, including Boris Berezovsky, who has called for outlawing the Communist Party in Russia. Zyuganov wrote the letter in the aftermath of criticism in parliament of Albert Makashov, a member of his party. In recent months, Makashov has made virulently anti-Semitic statements. The lower house of parliament, the State Duma, in which Zyuganov’s party is the largest single faction, has refused to condemn Makashov. “Zionism has in reality revealed itself as one of the varieties of the theory and practice of the most aggressive imperialistic circles striving for world supremacy,” according to Zyuganov, who also compared Zionism to fascism. “The only difference between them is that Hitler’s Nazism was performing under the guise of German nationalism and sought world supremacy openly. And Zionism, performing under the guise of Jewish nationalism, is operating stealthily, using other people’s hands.” Zyuganov said that by attacking Zionism he did not mean to attack Jews. “We have never put an equation mark between the notions of a ‘Jew’ and a ‘Zionist,'” he said. “The spread of Zionist ideology among the Jewish people is by far not the fault, but a misfortune of the Jewish people.” Zyuganov added that Jews were welcome to leave Russia, or recognize Russia “as their only “Motherland,” or “assimilate” into its ethnic groups, but they could not be some kind of “inner emigrant in it, acting for the damage of her interests in favor of another state or an international corporation.” “One of the reasons of the present catastrophic conditions of the country, mass impoverishment and dying out of its population,” Zyuganov insisted, was the “Zionization of the government authorities.” He claimed these officials were ignoring “the aggressive, destructive role of Zionist capital in ruining Russia’s economy and plundering her property owned by all.” Source: Washington Post, December 25, 1998. http://www.washintonpost.com/

1 1

Status Update: Privacy Dead, Surveillance Alive, Secrets Hidden
by grarpamp 05 Mar '17

05 Mar '17

https://theintercept.com/2017/03/03/the-governments-privacy-watchdog-is-bas… https://theintercept.com/2017/03/04/trump-wants-nsa-program-reauthorized-bu… https://theintercept.com/2017/03/04/if-trump-tower-was-wiretapped-trump-can… And govt and most everything else... fucked. Oh, wait, no status change since last time, sorry for the noise, dept of redundancy dept.

1 0

Building Global Community - Mark Zuckerberg
by Cecilia Tanaka 04 Mar '17

04 Mar '17

*Building Global Community - Mark Zuckerberg* https://www.facebook.com/notes/mark-zuckerberg/building-global-community/10… No, I am not giving my support, nor criticizing this post. Yep, obviously I loved the message, but I don't trust the sender. There's something strange screaming "It's A Trap!" very loud, guys. :-/ https://youtu.be/4F4qzPbcFiA There are lots of stories on Internet saying that Zuckerberg wants to be a presidential candidate in the next elections. He said is not an Atheist anymore very recently and, well, everybody knows that the USA will never elect an Atheist... :P http://www.telegraph.co.uk/technology/2017/01/03/mark-zuckerberg-reveals-no… I respect a lot Atheist people, but I also respect a lot who believes in God, Godesses, Prophets, Deities, etc, etc... Mirimir is my imaginary friend and I almost married under the blessings of the Flying Spaghetti Monster (it's serious, one of my best friends is a wise Pastafarian "Minister"!), so I can't complain about the other persons' imaginary friends. I just don't like religions and their eternal judgements... The FSM is very tolerant! :P ------- "Don't let anyone rob you of your imagination, your creativity, or your curiosity. It's your place in the world; it's your life. Go on and do all you can with it, and make it the life you want to live." - Mae Jemison

4 8

Re: [tor-talk] Tor Project Corporate Document FOI Request
by grarpamp 04 Mar '17

04 Mar '17

On 8/8/16, Ken Cline <cline(a)frii.com> wrote: > "various Licenses and Certificates held" A corporation can be issued, issue, and hold, various licences and certs, be they from or to, private or public entities, governments, or persons. Could be... vendor / reseller, awards, permission to bid / let [govt or other] contracts, provide services, etc. Use your imagination. TPI knows what it does or doesn't hold. And TPI can be transparent by listing them all proactively instead of requiring community go on phishing expedition for them by name. > "form blanks to be signed by new parties of all types" TPI has surely asked folks to fill out or sign, and been asked itself, regarding NDA's / [de]briefings, pre / during / post employment blanks, template blanket MOU's, etc. Use your imagination. TPI operates a corporate "office", a corporate office has form blanks for all sorts of uses. In particular when liasing with or initiating new parties of all types. As with the "new docs" someone posted for the future, folks are interested in seeing any similar docs applicable to the past. Only TPI knows what they were named. Those of employment and [process] acknowledgement are certainly higher than stupid petty cash and phone memo forms, come on now :) > [http://corp.sec.state.ma.us/corpweb/CorpSearch/CorpSearch.aspx] > "Articles Of Incorporation", "Charter", "Bylaws", and "Operating Agreement". > Except for Bylaws, these named documents do not exist. No, the state mandated Articles and Annuals exist there. NO!, the bylaws (another name for operating agreement), a highly relavant thing for transparency, do not seem to exist anywhere. Whatever other major structural and procedural docs may exist, who knows. Those are just some of the common names for them. Other people can add other names. Worth nothing is that whether or not any doc is [required to be] filed with government agencies, and whether or not it is publicly available from them once filed... is different from what TPI may choose to publish on its own for the community. > You will find their > Articles of Organization and Annual Reports, which contain relevant > information. Regardless, whatever is publicly available or FOIA-able on a government site should also be posted for transparency on TPI as well. > Others are on the Tor Web site itself: > ("List of Officeholders", "Executives", It's not necessarily clear, in a classically hierarchical org chart sort of way, who held all the various high titles and when. > "Voting Members" NO!, voting and election does not appear to be detailed at all anywhere. Only opaque references to "duly elected" and "adopted". And "member" often means certain things in corporate law as well. > Of course, there are no shareholders While "non-profit" (its own curiosity to be sure), may hold certain meaning and requirements in certain jurisdictions, the extension of that to concepts of founding / holding parties and redistribution, optionally to achieve "non-profit", may be different. Links to law refs on the topic could be useful for those that didn't already notice a reference to the possibility of that in the Articles (under powers). > precisely which people have voting power will be > detailed in the Articles of Organization or Bylaws. Pointless when the AOI says nothing there, and the bylaws aren't available. Nor can community be expected to wade through MA/US law to see if any particular "Officer" or "Director" is granted unwaivable voting rights under law. > Still others appear not yet available. Yes. > patience in obtaining the audited 2015 financials. If TPI's release of particular docs is governed by requirement of law, that's different. But if community can FOIA same from govt, there is no such requirement, and TPI should transparently publish. > "Meeting Minutes covering years 2010 ~ 2015" should be available. > I would contact the Tor Project directly (Executive Director's office, > maybe). No user, donor, or interested party should be pushed / required to go private fora like that. It's their right to ask in public, to do so by proxy person or tor etc, and to retain their motivations. And whatever TPI does with such requests is up to TPI. If it's transparent with servicable open fora, it's a non issue. It's also silly to be fielding multiple same requests when a single transparent proactive publication of same will serve everyone. Yes, minutes are very important for transparency. It's extremely unlikely the ED's office did not know, or was not informed, within no more than a few days of the request, probably more like a few hours. Certainly not a few weeks. > The issue you > filed in the tracking system was given medium priority, which seems proper Few could have problem with that. As before, only with lack of ack and general plan of reply. > your request It should not be considered mine, but a presentment of some community voices / ideas / tasks gone forgotten / unattended over time, into a more prominent and useful form. And with recent events pressing... journalists could easily be added to list of supporting and interested parties. Others are welcome to carry the request forward.

1 1

Re: [Cryptography] Text of Burr-Feinstein encryption backdoor bill
by grarpamp 04 Mar '17

04 Mar '17

> https://assets.documentcloud.org/documents/2797124/Burr-Feinstein-Encryptio… > https://www.burr.senate.gov/imo/media/doc/BAG16460.pdf Lawmaking, Crypto, and Weasel Words... One Random Read Between The Lines > A BILL > To require [crap] > and for other purposes Because "other purposes" is how you sneak in more unwanted crap behind the first crap. And how you avoid legitimate up or down on any single issue. Feature creep 101. > "Compliance with Court Orders Act of 2016" Sounds dreamy and routine doesn't it, just breeze over it on a lazy Sunday in the park and vote yes on Monday. Nothing to see here, move along. > It is the sense of Congress that ... These weasel words are particularly revolting, they smell like flowers but they're not. They vote for them because flowers... after all, their expected "sense" and thus their expected vote has already been printed on paper for them by their leaders, how could they ever vote against such pretty things. After gleefully voting for it, they then find themselves forever trapped because this "sense" has now been formally imposed upon their prior independance by law. Any dissent against the enacted flowers now becomes an embarrassing politically suicidal case of position changing, and illegal, because it's not following the official "sense". Disgusting. > (1) no person or entity is above the law Actually, they are, at least until the law exerts itself over special selectees among them, typically reserved for dissenters. > (2) economic growth prosperity security, stability, > and liberty require adherence to the rule of law Actually, none of these *require* any law, let alone blind adherance to it. > (3) the Constitution and laws of the United States > provide for the safety, security, and civil > liberties of all United States persons No, they don't, nor are there any such guarantees. > and the > protections and obligations of these laws apply to > all persons within United States jurisdiction No, they don't. Notice the routine trotting out of grand patriotic bullshit like this to dispel any critical thought and bank votes on shit laws. PATRIOT even had it in its title. > (4) all providers of communications services and > products (including software) "Software"... see, they snuck in the all encompassing grandaddy of them all... any / all / your "software", including opensource and private use, and extends to hardware as software in silicon. > should protect the > privacy of United States persons through implementation > of appropriate data security Stage setting under dissentproof "sense of congress" for future legislated "security". Lots of failure there. See also: CALEA Everywhere, plugin goatse version > and still respect the rule > of law and comply with all legal requirements and court > orders Attempt at washing away dissent, disrespect and noncompliance as unconscionable / evil acts, or unacceptable to even think of. > (5) to uphold both the rule of law and protect > the interests and security of the United States, Wait a minute, thought this US thing was about "we the people", now it's only about "of the United States" itself? > all persons receiving an authorized judicial order Wait a minute, judges issue their own independant orders, all the way up to the Supreme's, so now just exactly *who* is doing this "authorizing" above them? You don't think the Judicial Branch will just lay themselves over entirely to statutory law do you? Alternatively, just what is the police force of the Judiciary, and who does it report to? > for > information or data must provide, in a timely manner, > responsive, intelligible information or data, or > appropriate technical assistance to obtain such > information or data These days, thanks to your allowing them twisting it for 15+ years, "technical assistance" now includes indefinite detention and rubberhose "tech"niques, destruction of family / work life, asset forfeiture, etc. Also, tricking and ratting out others is hip. > (6) covered entities must provide responsive, > intelligible information or data, or appropriate > technical assistance to a government pursuant to a court order. All "entities" to any "a government" around the world? Nice one. Global Order [?] brought within a Sea of Pretty Flowers. Proudly passed by your Presidents and Congresses, stamped by Judges picked by same. People around the world need to be reading the crap that gets put in their laws, then getting rid of the crap that put it there.

2 1

Fwd: [Cryptography] Uber "Greyball"-ed city authorities w/fake screens
by grarpamp 04 Mar '17

04 Mar '17

---------- Forwarded message ---------- From: Henry Baker <hbaker1(a)pipeline.com> Date: Fri, Mar 3, 2017 at 6:53 PM Subject: [Cryptography] Uber "Greyball"-ed city authorities w/fake screens To: cryptography(a)metzdowd.com FYI -- https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-a… 'To build a case against the company, officers ... posed as riders, opening the Uber app' 'Uber had tagged [the officer] ... based on data collected from [his/her] app ... The company then served up a fake version of the app populated with ghost cars' 'When Uber moved into a new city, [an Uber employee] ... would try to spot enforcement officers. One technique involved drawing a digital perimeter, or "geofence," around the government offices ... people were frequently opening and closing the app ... near such locations as evidence that [they] might be associated with city agencies. Other techniques included ... credit card information and determining whether the card was tied directly to an institution like a police credit union.' http://www.cultofmac.com/304401/ubers-android-app-literally-malware/ Uber's data-sucking Android app is dangerously close to malware [updated] By Buster Hein -- 11:22 am, November 26, 2014 Uber has been sideswiped by a ridiculous number of controversies lately, but things are about to get even worse for the ride-sharing service. A security researcher just reverse-engineered the code of Uber's Android app and made a startling discovery: It's "literally malware." Digging into the app's code, GironSec (http://www.gironsec.com/blog/2014/11/what-the-hell-uber-uncool-bro/) discovered the Uber app "calls home" and sends data back to Uber. This isn't typical app data, though. Uber has access to users' entire SMSLog even though the app never requests permission. It also accesses call history, Wi-Fi connections used, GPS locations and every type of device ID possible. The app even checks your neighbor's Wi-Fi and retrieves info on the router's capabilities, frequency and SSID. News of the app's vulnerability was first posted on Hacker News with the charming intro, "TLDR: Uber's Android app is literally malware." (https://news.ycombinator.com/item?id=8660336) One developer commenting on the revelation said there isn't "any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it. There should probably be legal action." Here's the full list of all the data Uber is collecting through its Android app (we're checking to see if the iOS version works the same way): -- Accounts log (Email) -- App Activity (Name, PackageName, Process Number of activity, Processed id) -- App Data Usage (Cache size, code size, data size, name, package name) -- App Install (installed at, name, package name, unknown sources enabled, version code, version name) -- Battery (health, level, plugged, present, scale, status, technology, temperature, voltage) -- Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, IP, MAC address, manufacturer, model, OS platform, product, SDK code, total disk space, unknown sources enabled) -- GPS (accuracy, altitude, latitude, longitude, provider, speed) -- MMS (from number, MMS at, MMS type, service number, to number) -- NetData (bytes received, bytes sent, connection type, interface type) -- PhoneCall (call duration, called at, from number, phone call type, to number) -- SMS (from number, service number, SMS at, SMS type, to number) -- TelephonyInfo (cell tower ID, cell tower latitude, cell tower longitude, IMEI, ISO country code, local area code, MEID, mobile country code, mobile network code, network name, network type, phone type, SIM serial number, SIM state, subscriber ID) -- WifiConnection (BSSID, IP, linkspeed, MAC addr, network ID, RSSI, SSID) -- WifiNeighbors (BSSID, capabilities, frequency, level, SSID) -- Root Check (root status code, root status reason code, root version, sig file version) -- Malware Info (algorithm confidence, app list, found malware, malware SDK version, package list, reason code, service list, sigfile version) Uber might have a legitimate reason to use most of this info in the app, perhaps for fraud detection or an intelligence-gathering tool. The problem is that the information is being sent and collected by Uber's servers without users' knowledge or permission. Sen. Al Franken sent a letter to Uber CEO Travis Kalanick last week demanding the company account to the public for its data gathering. The letter came as a response to a recent controversy where an Uber executive threatened to spy on and blackmail journalists who wrote unfavorable articles about the company. Uber's "God View" tool, which gives company insiders unlimited access to riders' data, has also been a cause of concern in recent weeks. Cult of Mac asked Uber for comment on the collection and transmission of the data its Android and iOS apps are performing, but haven't received a response. Update: Uber has provided some clarification to the company's data gathering, noting that the blanket access is actually a requirement from Google, which forces Android developers to ask for privacy permissions up front. Uber spokeswoman Lara Sasken released the following statement to Cult of Mac: "Access to permissions including Wifi networks and camera are included so that users can experience full functionality of the Uber app. This is not unique to Uber, and downloading the Uber app is of course optional." Recode notes that Uber-competitor Lyft requests access to the same data on Android. Unlike iOS and Windows, Android developers are encouraged to request access to more user data than their apps actually need. The Uber app on Android exposes some the mobile operating system's weakness in privacy compared to iOS and Windows, both of which allow users to refuse access to data on an case-by-case basis. Additional information on Android permissions can be found on Uber's site here (https://m.uber.com/android-permissions) but not every feature is explained. ----- This article about the Ubar app as malware is several years old, but today's NYTimes article "How Uber Used Secret Greyball Tool to Deceive Authorities Worldwide" explains for the first time one of the real reasons for Uber's prurient interest in its users' data. Now that we know these reasons for Uber's spying, it becomes clear what information collected by Uber's app could be used to track authorities who are trying to catch Uber drivers in illegal activities. Uber's bloated app size (215MBytes on iOS -- probably required for all the fake screens, ghost cars, etc.) can be seen as an all-out assault on every one of its user's privacy. This NYTimes article also explains why Uber wants so desperately to spy on its users *all* the time (http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app… -- "Uber wants to track your location even when you're not using the app") -- not just when these users are utilizing Uber cars! _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0