December 2019 - cypherpunks@lists.ogf.org

CNBC: Senators threaten to regulate encryption if tech companies won't do it themselves
by jim bell 11 Dec '19

11 Dec '19

CNBC: Senators threaten to regulate encryption if tech companies won't do it themselves. https://www.cnbc.com/2019/12/10/senators-threaten-encryption-regulation-for…

2 1

Bloomberg: Encryption Backdoors Won't Stop Crime But Will Hurt U.S. Tech
by jim bell 11 Dec '19

11 Dec '19

Bloomberg: Encryption Backdoors Won't Stop Crime But Will Hurt U.S. Tech. https://www.bloomberg.com/view/articles/2019-12-10/encryption-backdoors-won…

2 1

Dan Geer: nothing can make online trustworthy
by John Young 11 Dec '19

11 Dec '19

Dan Geer, legendary cyber-pro, claims nothing can make online trustworthy. Users should forego cyber addiction exploited by predators through inherent tech weaknesses. Source: "Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers," Andy Greenberg

1 0

CSO Online: The race for quantum-proof cryptography
by jim bell 11 Dec '19

11 Dec '19

CSO Online: The race for quantum-proof cryptography. https://www.csoonline.com/article/3488857/the-race-for-quantum-proof-crypto…

1 0

cypherpunks-legacy archives 1992-2013
by Greg Newby 10 Dec '19

10 Dec '19

Back in July there was discussion about preserving the available archives. I have now made the available archives from 1992-2013 available via Mailman, and placed copies of the available mbox files within. Visit them here: https://lists.cpunks.org/pipermail/cypherpunks-legacy/ The main info page, which links to the sources and a description of what was involved in getting them into Mailman, is here: https://lists.cpunks.org/mailman/listinfo/cypherpunks-legacy Finally, here is the README-processing file that describes what I did, and why I decided to not try to incorporate those older archives with the current list archives at https://lists.cpunks.org/pipermail/cypherpunks/. Suggestions welcome. -------- Processing of Cypherpunks Archives Available archives of the Cypherpunks email list are incomplete, and in fact there is evidence they have been tampered with and/or redacted over the years. This project was to do some basic clean-up of available archives, which are in mbox format, so that they could be ingested and be viewed within Mailman. The archives contain many poorly formed messages, and Mailman defaults to the current date (December 2019, at the time of this writing) when it encounters a problem with the date. So, a separate 'cypherpunks-legacy' list was deployed to make the archives available without overlapping with the current active 'cypherpunks' list, which goes back to July 20 2013. Otherwise, the legacy archive messages would have been peppered into the current archives, in ways that would be difficult to predict or undo. There were especially many anomalies from the larger source, spanning 1999-2015. In addition to many poorly formed messages (i.e., messages that, in one way or another, could not be cleanly ingested with the Mailman 'arch') comment, there were invalid dates, and lines that had an errant "From " at the start. To ready the sources for ingestion to Mailman two automated tools were utilized, followed by some ad hoc edits and changes: 1. 'sortmbox.py' uses a Python library to put messages in by-date order. This proved to be less confusing to Mailman (i.e., fewer messages were inserted to the current month). 2. 'cleanarch' (/var/lib/mailman/bin/cleanarch) is part of the Mailman package. It fixes errant "From " entries at the start of lines. 3. I also used 'sed' to replace invalid dates with valid ones that were in the same ballpark day+time as the message. I found these either when 'arch' complained (such as for dates before the Unix epoch), or when Mailman was showing messages in the future: 's/ 0101 / 1999 /' | sed 's/ 0102 / 1999 /' 's/Thu Dec 31 22:40:39 1903/Thu Jul 5 22:40:39 2018/g' 's/Jan 1904/Jul 2018/' 's/Date: Sun, 1 Apr 2029 03:07:16 +0200/Date: Sat, 31 Mar 2001 15:59:46 -0800/' 's/Date: Fri, 3457 Jan 4 61400:2064:61300 +0200/Wed May 29 15:00:02 2013/' There might have been a few other small edits made within the files, which I didn't record, simply to help Mailman to do a better job of creating browsable archives. 4. I then concatenated all the mbox files (one each for 1992-1998, plus one larger file for 1999-2015), and reran sortmbox.py and cleanarch. 5. I edited the resulting file to remove everything after the new list archives were set up, on July 20 2013. To do the work above, I created a temporary Mailman list, and repeatedly used the 'arch' command to ingest the archives and fix problems. This was an iterative process. Once 'arch' was giving sane output, I created a new Mailman list, 'cypherpunks-legacy.' I put the single unified + fixed mbox file where Mailman tools would find it: /var/lib/mailman/archives/public/cypherpunks-legacy.mbox/cypherpunks-legacy.mbox At this point, I could use the Mailman to slurp the mbox files in, and create the browsable structure. The 'arch' command: /var/lib/mailman/bin/arch --wipe cypherpunks-legacy This served to populate the list archives, which are browsable here: https://lists.cpunks.org/pipermail/cypherpunks-legacy The single large mbox file resulting from the steps above is linked at the top of the Archives page. Here is a direct link: https://lists.cpunks.org/pipermail/cypherpunks-legacy.mbox/cypherpunks-lega… (615MB, containing approximately 180149 messages) Please be aware that Mailman's placement of messages by author, date, subject and thread - including the correct by-month folder - is not perfect. Messages sometimes end up in the wrong place, and sometimes threads are split across different years. Also note that these mbox files did not include attachments. The current Mailman archive does include attachments, but this legacy archive does not. It seems they were not included with the archive input sources (though it's possible some messages have MIME-encoded attachments within them). Anyone interested in doing a serious dig into the archive should also consult the original mbox files. These can be ingested into any capable email client program, and viewed as separate messages. They may be sorted and searched, just like any other email folder. The same sorts of issues as those described above will likely be evident in any email client, and clients will even show a different total number of messages. The types of sorting, editing, and displaying described above would have somewhat different results, if a different toolset is used. These archives are freely available, and the effort to make them available via Mailman is freely given. - gbn -------- Earlier thread on this concluded below: Subject: Re: newsflash! cypherpunks mailing list is behind cloudflare-NSA On Fri, Jul 12, 2019 at 06:34:07PM -0400, grarpamp wrote: > On 7/12/19, Greg Newby <gbnewby(a)pglaf.org> wrote: > > Newsflash! This happened in April, and was announced here: > > https://lists.cpunks.org/pipermail/cypherpunks/2019-April/045250.html > > We have been on Cloudflare's DNS since then for the email lists. > > Use of CF or any other CDN was not mentioned in the announcement, > whether for DNS, or HTTPS. The entire internet is NSA anyway. > > If CDN for HTTPS, consider multihoming on I2P or Tor > so users can still access when CDN javascript captcha > or otherwise arbitrarily blocks them or goes down. > > As to caching bandwidth and archives... > > You really should fork that 335MiB mbox file off now > or no later than year end, and compress it, and > then once yearly thereafter, and sign them all. > People will eventually seed them into IPFS, etc. > > Try using a modern unix compression tool like zstd, > they are faster, smaller, available for all systems... > > https://github.com/facebook/zstd > https://facebook.github.io/zstd/ > https://code.fb.com/core-data/zstandard/ > https://en.wikipedia.org/wiki/Zstandard

3 3

Facialized: Amazon Outs Users Locations
by grarpamp 10 Dec '19

10 Dec '19

https://gizmodo.com/ring-s-hidden-data-let-us-map-amazons-sprawling-home-su… How's it feel for you and your family to be fucked by both your neighbor and govcorp including Amazon? You're not doing anything about it, so you must enjoy it. An investigation by Gizmodo has revealed that it's possible to obtain the locations of Ring doorbell cameras from post on Amazon's Neighbors app. Amazon has continuously deflected criticism and claimed it is dedicated to user privacy. The company insisted Ring users have a "choice in what information, if any, they share with law enforcement." It turns not only can law enforcement access the exact location of users, but anyone, anywhere can find out where users live. Gizmodo was able to locate geographic coordinates for more than 20,000 camera. Some of the coordinates placed you directly in front of the Ring device, while other coordinates were a couple hundred feet yet identifiers from posted videos made it easy to locate the user's home. "People have been misled into buying these devices because Amazon tells them it will keep their family safe. But it's a lie. Amazon's surveillance network puts us all in danger," said Evan Greer, deputy director of Fight for the Future. "Any bystander caught by a Ring device could be located using the geographic coordinates found. People can be tracked going into buildings, like clinics, for private appointments. Children captured on video could be located by people with malicious intentions. The possibilities are endless. Amazon has failed to put any protections in place. Now, we're all vulnerable to the consequences of their dragnet. We need Congress to investigate, and hold Amazon accountable for these dangers."

1 0

Cryptocurrency: War on Cash - The Great Greek Tax Grab
by grarpamp 10 Dec '19

10 Dec '19

https://www.smh.com.au/business/markets/greeks-set-to-face-heavy-fines-if-t… https://i.redd.it/as0o6kbz4b341.jpg https://old.reddit.com/r/Bitcoin/comments/e8qdwi/pretty_good_selling_point_… https://old.reddit.com/r/Bitcoin/comments/e8jimf/greeks_set_to_face_heavy_f… https://old.reddit.com/r/Bitcoin/comments/e8qw0u/bitcoin_looks_ideal_in_gre… https://news.slashdot.org/story/19/12/10/1614216/greeks-set-to-face-heavy-f… Greeks will be hit with a hefty fine if they do not spend almost a third of their income electronically in an unprecedented bid by the new government to stamp out rampant tax evasion. The government expects to raise more than $808 million every year from the initiative that will force Greeks to spend 30 per cent of their income electronically, Alex Patelis, the prime minister's chief economic adviser, revealed. Individuals that fail to meet the target will be hit with a 22 per cent fine on the shortfall. Therefore, if an individual spends just 20 per cent of their income through electronic means, they would face a 22 per cent tax on the remaining 10 per cent bar some exclusions. The scheme is a radical attempt to cast some light on Greece's huge shadow economy, the world's largest, and is part of new prime minister Kyriakos Mitsotakis's sweeping overhaul to revive growth. https://www.coindesk.com/georgia-governor-appoints-bakkt-ceo-loeffler-as-ne… https://i.redd.it/9ekwt4zr5z241.png https://i.redd.it/l49n3l22sh341.jpg Demand for CCDEX = high. https://www.theblockcrypto.com/post/49621/deutsche-bank-says-crypto-could-r… https://thetokenist.io/germany-passes-law-enabling-banks-to-store-cryptocur…

1 0

Iran Cuts Internet, Toosheh SDR, Appelbaum
by grarpamp 10 Dec '19

10 Dec '19

https://twitter.com/netblocks/status/1195775905907576832 https://twitter.com/Maryamtaban12/status/1195792928934944768 * Down with Dictator * Down with Rouhani (President) * Down with Khamenei (Supreme Leader) "The Iranian government forces all ISPs in the country to be singlehomed to, and be downstream of, DCI, the government run ASN. If you don't do this, you don't get an international transit connection, and men with guns come to take your routers and arrest you." https://twitter.com/radiojibi/status/1195802219884503040 https://en.wikipedia.org/wiki/Toosheh Jacob Appelbaum https://www.youtube.com/watch?v=bIvt9snFQig https://www.youtube.com/watch?v=0qa8SRN86V8

2 1

Plundervolt: Intel CPUs Hacked... Again - SGX
by grarpamp 10 Dec '19

10 Dec '19

https://plundervolt.com/ https://github.com/KitMurdock/plundervolt https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… Academics from three universities across Europe have disclosed today a new attack that impacts the integrity of data stored inside Intel SGX, a highly-secured area of Intel CPUs. The attack, which researchers have named Plundervolt, exploits the interface through which an operating system can control an Intel processor's voltage and frequency -- the same interface that allows gamers to overclock their CPUs. Academics say they discovered that by tinkering with the amount of voltage and frequency a CPU receives, they can alter bits inside SGX to cause errors that can be exploited at a later point after the data has left the security of the SGX enclave. They say Plundervolt can be used to recover encryption keys or introduce bugs in previously secure software. Intel desktop, server, and mobile CPUs are impacted. A full list of vulnerable CPUs is available here. Intel has also released microcode (CPU firmware) and BIOS updates today that address the Plundervolt attack [by allowing users to disable the energy management interface at the source of the attack, if not needed]. Proof-of-concept code for reproducing attacks will be released on GitHub.

1 0

ShadowSocks: Doubi of SSr Nabbed Under Twitter Questions
by grarpamp 10 Dec '19

10 Dec '19

https://mobile.twitter.com/robert_spalding/status/1134797195771863041 Is Twitter leaking user phone numbers to the Chinese police, or have they been hacked? People are being called in for questioning about their Twitter activity. 5:21 AM - 1 Jun 2019 https://amp.ft.com/content/afd44222-5c34-11e9-9dde-7aedca0a081a Chinese authorities step up crackdown on Twitter users Police warn people for liking posts that insult leaders or even opening an account. " Here is a story what has happened to Doubi (SSr developer.) He was a very well aware of anonymity risks, and he evaded police for years on end. China literally tried to do geolocate him by turning off the internet in entire cities, but to no result. He caught on to that, and started randomising his release timing, and avoiding releasing "hotfixes". So, the entire Chinese police and MSS been looking him for 4-5 years. What has happened? A few month before his arrest, he registered a Twitter handle with a throwaway SIM card. Those are being usually sold by "grannies" in Chinese 2nd tier cities who peddle things like fake tax receipts, anonymous train tickets and such. China either hacked Twitter, or had somebody bribed there, and they got the number. They then tracked down the granny who sold him the SIM card, and went on and checking every person door to door in that small town. Then, they found him. He got 5 years prison, and 4 years of laogai (gulag) Basically Twitter got pwned big time, and now denies it because GDPR will ruin them if breach is proven. Here is what Doubi's online followers figured: State security got all phone numbers used for Twitter phone verification up to May 2019 and possibly till July. Twitter haphazardly closed the breach in complete secrecy. API hole explanation is excluded as people with 100% private accs got police visits. People with foreign SIM cards also got into trouble. So the explanation that China compromised Twitter's SMS providers is also excluded, as its improbable that they did it in 4+ countries. 2016 breach is also out of question. The only explanation is that they got hold on a big piece of their user DB, or, worse, they have an active infiltrator in Twitter, or Twitter voluntarily cooperated. "

2 1