April 2017 - cypherpunks@lists.ogf.org

Pike Committee Reports [was: Ask yourself this]
by grarpamp 05 Apr '17

05 Apr '17

Ref the former thread. Pike Committee Reports in a new format... http://maryferrell.org/php/showlist.php?docset=1918 About the Mary Ferrell Foundation The Mary Ferrell Foundation (MFF) is a non-profit 501(c)(3) group engaged in an ongoing effort to bring accessible and interactive history to a new generation of critical thinkers. With a wide topic base including the assassinations of the 1960s, the Watergate scandal, and post-Watergate intelligence abuse investigations, the MFF’s vast digital archive at www.maryferrell.org contains over 1.3 million pages of documents, government reports, books, essays, hours of multimedia, and innovative research tools.

1 0

The Crypto Show 89.1 FM TXLR Austin,TX
by grarpamp 05 Apr '17

05 Apr '17

https://www.youtube.com/channel/UCH720dsEFqx0gYyQrLZHCEQ/videos Cody Wilson on The New Radical https://www.youtube.com/watch?v=tAUJujvNHlc You eeeediot :)

1 0

In 25 yrs Bill Gates will be the first TRILLIONAIRE ... half of India's GDP
by Razer 05 Apr '17

05 Apr '17

First trillionaire: In 25 yrs Bill Gates’ wealth to be half of Indian GDP Updated: Jan 25, 2017 10:33 IST Microsoft founder Bill Gates, of the Bill & Melinda Gates Foundation gestures during a session of the World Economic Forum(AFP) Bill Gates, the co-founder of technology behemoth Microsoft, is on track to become the world’s first trillionaire, according to a report by Oxfam, the England-headquartered confederation of charitable organizations focused on the alleviation of global poverty. To put things in perspective, the total gross domestic product of Indonesia is less than a trillion dollar. That means Gates as a trillionaire would have more wealth than what Indonesia produces in goods and services in one year. India, too, has a skewed proportion of wealthy people. The report quoted that Swiss global financial services company, UBS estimates that in the next 20 years, 500 people will hand over $2.1 trillion to their heirs, a tad less than the GDP of India, a country where 1.3 billion people live. Gates’ fortunes has risen by 50%, or $25 billion since he left Microsoft in 2006, “despite his efforts to donate much of its in charity,” the report said. Gates runs the Bill and Melinda Gates Foundation, which works to improve education, world health and population, and around community giving. In the 10 years after Gates took up social work, his net worth has grown to $75 billion. The Forbes magazine calculates his net worth at $84 billion. “If billionaires continue to secure these returns, we could see the world’s first trillionaire in 25 years. In such an environment, if you are already rich you have to try hard not to keep getting a lot richer,” the report elaborated. The flipside: the huge fortunes in the hand of few is a “clear evidence of inequality crisis”, and is hindering the “fight to end extreme poverty”. India, too, has a skewed proportion of wealthy people. The report quoted that Swiss global financial services company, UBS estimates that in the next 20 years, 500 people will hand over $2.1 trillion to their heirs, a tad less than the GDP of India, a country where 1.3 billion people live... More: http://www.hindustantimes.com/business-news/bill-gates-the-world-s-first-tr…

4 4

Re: [Cryptography] Tempest and limits on receiving
by grarpamp 05 Apr '17

05 Apr '17

> That law was adopted in the US for consumer privacy reasons back when > cell service was analog and unencrypted, and cellular conversations > could be listened to with an off-the-shelf scanner. It is less > relevant today, but still on the books. AMPS is long dead in the US, but you don't see that now irrelavant and useless thing being removed from "law" do you. (Well, more applicably, "cordless household phones", which have also evolved somewhat beyond a simple fixed 800MHz carrier. Regulate Technology vs. Act, stupid govt's.)

1 0

Re: [Cryptography] Regulations of Tempest protections of buildings
by grarpamp 05 Apr '17

05 Apr '17

> Leichter wrote: >> Sorry but if you can't see the written law, promulgated regulation, or >> included by reference junk, even as an indigent for lols, then it doesn't >> exist, you don't have to comply with it, and can't be prosecuted for it. >> There is a very famous guy (can't find link) who goes around suing >> FOIA / States / Jurisdictions over this bullshit secret law proprietary >> copyright trademark access fee crap, and winning. > You're thinking of Carl Malamud ... who as it happens just *lost* a case in US District Court against Georgia, whose full official laws, in hardcopy, were only available to him from LexisNexis for $1,207.02. See https://arstechnica.com/tech-policy/2017/03/public-records-activist-violate… > > There are many state laws a regulations that "include by reference" standards published by various organizations who sell them for large amounts of money. Yes, you are legally responsible for working within the standards. If people want to be apologists for the Secret Arbitrary Control Profit State, they exactly deserve what they get, and such things do and will affect you eventually. oh, are you going to praise the $1000 it costs you do buy the driver / tax / employment / marriage "law". If you can't see, read, debate, contest and ply to modify the entirety of the law, freely, even as a $broke bum on the street, it's not a law. This is absolutely fundamental principle and requirement of working "democracy", among other memes. Otherwise you're a subject of tyranny of elites who don't give a fuck about you. Nobody cares it you take the public body of law, *add* your own annotations, work, etc, and resell that product... that is *not* law. Of course Malamud will lose that. However that's entirely different than the law public itself, including all "included by references", etc. If it is work product of Legislative, Judicial, Executive branches, it must be free and freely available, and so must all such deliberated included's... this is fundamental here. If you have to pay to see that which you must comply with, it isn't law, and you have a rock solid case to ignore it, unless of course too many apologists have made that slippery slope happen, for which you're doomed. You're a complete fool to comply with a "law" you cannot freely read for free. Show me the law, I'll make my own damn "annotations".

1 0

Re: [Cryptography] Does anyone here know PAM?
by grarpamp 05 Apr '17

05 Apr '17

On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker <phill(a)hallambaker.com> wrote: > This is a call for technical assistance with a crypto project. Hopefully it > will be of wider benefit if successful. > > The Mathematical Mesh has the goal of making computers easier to use by You mean http://www.prismproof.org/ > making them more secure. Note the order. While there are some times that it > is appropriate for a cryptographic key to require the user to enter a PIN or > the like to use it, that cannot be the default requirement, nor is it > acceptable to just leave private keys sitting on disk unencrypted. > > Windows and OSX both provide features that cause private keys and other > credentials to be unlocked automatically using the user's password as a PIN. > I want to achieve the same on Ubuntu. I am happy if the solution can also be > carried across to other Linux and FreeBSD but don't have resources to cover > anything else. Various tools / ports / projects in both Linux and BSD do exist that will get you magical login encrypted homedirs. OSX also has it. Now that per dataset crypto keying is in ZFS, you might expect to see some uniform use of it spread across everything except Windows. http://open-zfs.org/wiki/ZFS-Native_Encryption https://youtu.be/frnLiXclAMo https://drive.google.com/file/d/0B5hUzsxe4cdmU3ZTRXNxa2JIaDQ/view?usp=shari… http://pefs.io/ https://github.com/glk/pefs https://wiki.freebsd.org/PEFS http://glebkurtsou.blogspot.com/search/label/pefs You could find other implementations, FUSE, PAM, login, etc here... https://www.freebsd.org/ports/categories-grouped.html Linux does bunch of things with FUSE / PAM / dmcrypt. Even the old NFS crypto loopback still exists. > The authentication mechanism is PAM. So far, the only documentation I have > found has been of the barely more comprehensible than the code variety. https://en.wikipedia.org/wiki/OpenPAM http://www.openpam.org/ https://www.freebsd.org/cgi/man.cgi?apropos=1&query=pam https://www.freebsd.org/cgi/man.cgi?query=pam.conf > * Is hooking PAM the way to go Probably, or quite commonly. More tricky is defining and detecting whatever is considered to be a logout state, timeout, loss of human user, etc. > or should I try to make use of an encrypted > directory mechanism instead? If that is what you want as part of an outcome, then yes. > * If PAM is the way to go, where might I find a working example for using > the login password to unlock a private keystore? See above links. Other people will probably post others. > * Has someone already done this for GPG Agent? Probably. > In addition, one of the layered applications, Mesh/Confirm offers two factor > authentication (among other things) so an example showing how to integrate a > network authentication mechanism would be useful. > > The architecture I am thinking of would be: > > 1) User logs in with password. > > 2) Password is passed to the unlock keys mechanism which uses it to unlock a > master key. > > 3) Processes running under the master key account can request unlocking of > profile data stored under it. > > Of course, it is quite possible that the magic required to bridge the gap > between 2 and 3 means effectively recreating GPGAgent.

3 3

gnupg-agent stores pass phrases until power-off
by Steve Kinney 04 Apr '17

04 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2017 01:44 PM, grarpamp wrote: > On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker > <phill(a)hallambaker.com> wrote: >> * Has someone already done this for GPG Agent? > > Probably. gnupg-agent is in serious need of some bugfixes, at least the version that makes it into Mint. Once it sees a pass phrase, gnupg-agent retains it until the system is shut down; stored pass phrases persist through user logout/login. This behavior is supposed to be controlled by a config file where a timeout can be set, but none is present in the default installations I have seen on Mint, and creating a new gpg-agent.conf as directed in the man page for gnupg-agent does exactly nothing to alter its behavior. The Debian devs say this is a non-issue. Their excuse: "Physical access is game over." How's that for convenient? Never mind that broken gnupg-agent means physical access by any unskilled snooper gives that person the ability to read and copy encrypted documents and files, or apply your signature to anything, while your back is turned. Not an issue. The presence of your pass phrase in system memory, as/when a non-persistent exploit checks to see if pass phrases for the secring keys it just sent to its owner are available in memory is not a potential issue, either. My work-arounds for this BS: http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJY4/dcAAoJEECU6c5XzmuqRZsH/j+n/25kHvoGh67IslBPrw1B 19Bkv4iSTTFf+t7dSNK10r91MzE4Li+m4p1jh2jYmz0Irle+le5gVmKFklDJXj4S UKVzmK89uhYTdUbWIuld+oAX3TIPfCNz88wwAqAl+YljTOrd1hS6hw8YKj62QElg dPRY/og3qsSTUU8mi5d57pae4yqaHQ5Gq9qZkxMIKByz5ZiOsxUoRslwhkWwaMp9 6Bcm2p7BAyKXOE9ZSWUp/0GjyB0BSwuMLgQtj2R4FJDcqIJ4/YLc5SI7OgFSwYjx u3Yy9+XAeF3+nQaVH8woFMPr7MiKHexDpdzQtsAZ1FcF+LF04vJcaFJF11gzvdo= =rTK8 -----END PGP SIGNATURE-----

1 0

gnupg-agent stores pass phrases until power-off
by Steve Kinney 04 Apr '17

04 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/04/2017 01:44 PM, grarpamp wrote: > On Tue, Apr 4, 2017 at 10:04 AM, Phillip Hallam-Baker > <phill(a)hallambaker.com> wrote: >> * Has someone already done this for GPG Agent? > > Probably. gnupg-agent is in serious need of some bugfixes, at least the version that makes it into Mint. Once it sees a pass phrase, gnupg-agent retains it until the system is shut down; stored pass phrases persist through user logout/login. This behavior is supposed to be controlled by a config file where a timeout can be set, but none is present in the default installations I have seen on Mint, and creating a new gpg-agent.conf as directed in the man page for gnupg-agent does exactly nothing to alter its behavior. The Debian devs say this is a non-issue. Their excuse: "Physical access is game over." How's that for convenient? Never mind that broken gnupg-agent means physical access by any unskilled snooper gives that person the ability to read and copy encrypted documents and files, or apply your signature to anything, while your back is turned. Not an issue. The presence of your pass phrase in system memory, as/when a non-persistent exploit checks to see if pass phrases for the secring keys it just sent to its owner are available in memory is not a potential issue, either. My work-arounds for this BS: http://pilobilus.net/gnupg-agent_work_around_for_linux_mint.html :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJY4/aFAAoJEECU6c5XzmuqfqkIAKEccOp/KQbJ5AFyK0/Npsbn pwVRaiAokE+WqkclDsLmUmB5vqBu+eg4YJIhj0c2gig/55slyCn74kp8Eu0GlOHF 2/qDddjnu6yz91uQs3uoIffYzKvNTXz06THXSn8DQ/nzQVIdy2g67pO2/OqxVp7j cIex0XA02U2ThQGjMMVpg7EIFRrnmzFx9k+BH5wWI2tiHjPWFz/ISaEfq0xx/RwM FVJTQNGLMmKyHwmo1Nez8ZiM+4eZz3Oz9BdaH4yHnOQpI1z9nYY5jeYlOMuaEs6o TZ1+4XTj4tX6sa3PJj8Z57bBWkyFeZzgRC2aipelssT9ui3+J7Qi1ciEAtbfBRg= =j/Vm -----END PGP SIGNATURE-----

1 0

Re: [Cryptography] Regulations of Tempest protections of buildings
by grarpamp 04 Apr '17

04 Apr '17

On Sun, Apr 2, 2017 at 9:17 PM, Harlan Lieberman-Berg <hlieberman(a)setec.io> wrote: > One thing that may be true (this will vary highly with jurisdictions) is > that buildings which block the effective use of radio bands used by the > fire service may be required to install a repeater. This isn't a /ban/ > on such constructions, but rather an additional requirement for those > who do. Not all jurisdictions will require this, but some will: NYC, > for example, it's section 917.1.2 of the NYc building Code and FC511 of > the New York City Fire Code. > > (Nationally and internationally, the model codes are in Annex O of the > NFPA 1 and IBC 915 / IFC 510. Reviewing these may be difficult; > unfortunately, building codes are proprietary in most jurisdictions.) Sorry but if you can't see the written law, promulgated regulation, or included by reference junk, even as an indigent for lols, then it doesn't exist, you don't have to comply with it, and can't be prosecuted for it. There is a very famous guy (can't find link) who goes around suing FOIA / States / Jurisdictions over this bullshit secret law proprietary copyright trademark access fee crap, and winning. He's also going after inhouse crap like PACER, and farmed out junk like LexisNexis. And prople are trying to go after FISC/FISA/PATRIOT too.

1 0

The ideal IoT gift for beauties
by Georgi Guninski 04 Apr '17

04 Apr '17

The ideal IoT gift for beauties: http://www.theregister.co.uk/2017/04/04/intimate_adult_toy_fails_penetratio… Wi-Fi sex toy with built-in camera fails penetration test

1 0