- cypherpunks@lists.ogf.org

Why I can't sleep soundly with blockchain, being the cypherpunk
by Sergey Matveev 17 Sep '17

17 Sep '17

Greetings, fellow cypherpunks! There is so much hype about blockchain technologies! Everyone is fascinated about it, dream about wonderful bright cryptofuture, and stops talking with me, when hears that I do not find blockchain either interesting or useful. Why I do not like blockchains? Actually *if they would work*, from cryptographic point of view, then I have nothing against! Distributed trusted databases, timestamps and consensus making are great things to deal with. But unfortunately I see that at least Bitcoin (the biggest blockchain in use) has already failed without human-initiated regulations[0]. It failed from *cryptographic* point of view. I am cypherpunk and I am very interested and excited about cryptography subjects. Why? Because all of that is based on math and assumptions about practical impossibility of reverting many functions (you know, some kind of "2^100 of operations are required for ..."). It is valuable because you do not have to trust and rely on people *at all*. Well, except for cryptographers and similar scientists. People are the problem #1 in all security questions. They can be bribed, all of them have their price. They are error-prone, not reliable, lie and misbehave easily. I can not sleep soundly, knowing that I depend on some human. Cryptography world gives unbelievable possibility to eliminate them! If I can easily remember relatively long passphrase (100-120 characters in practice) as a key to proven strong authenticated encryption algorithm, then I am confident that my data is safe. I can use eavesdropped links and virtually any potentially vulnerable storage when cryptography is applied correctly. While noone ever know if quantum computers powerful (big) enough will be built, RSA/ElGamal/ECC stay pretty safe too. I really love the fact of security risks estimation possibility, based on current technology state and progress. People can fail you anytime -- only *hope* will keep you calm. Are you afraid of algorithms breaking possibility? Even one of the first encryption algorithm used in computer era -- DES, is still useful and secure enough in 3DES composition. If you are still frightened, then learn from soviets: their GOST 28147-89 block cipher[1], created in 1970s, still has more than 2^200 security margin. Who the hell knows what "key meshing"[2] means? But that block cipher has that kind of thing, making it immune to Sweet32 attack, appeared dozens of years after. Do not overestimate value of performance, by sacrificing its security -- perfect advice for sleeping well for years. But what about blockchains? Citing Ethereum's "problems" wiki page[3]: While a cryptographer is used to assumptions of the form "this algorithm is guaranteed to be unbreakable provided that these underlying math problems remain hard", the world of cryptoeconomics must contend with fuzzy empirical factors such as the difficulty of collusion attacks, the relative quantity of altruistic, profit-seeking and anti-altruistic parties, the level of concentration of different kinds of resources, and in some cases even sociocultural circumstances. Everything is right here. Anyway you *will* depend on people, society, its behaviour and huge quantity of empirical factors and assumptions. It is not cypherpunk's reliable and risks-predictable world -- it has nothing in common. Replacing the need to trust the human, with the need to trust the algorithm and technology -- that *is* the exact reason why I am interested in crypto. Requiring and depending on society again -- that is the exact reason why I standing aside from blockchains. They do not offer any guarantees[4], but likelihoods, lottery. Cypherpunk must rely and depend on people as little as he can. Remember cypherpunk's manifesto[5] -- spread as little unnecessary information as possible, because people *will* find ways how to harm you with it. And blockchains are broadcasting permanent storages, where most of them (with Zcash[6] exception for example) give you neither privacy nor anonymity for your personal (private) transactions. [0] https://en.wikipedia.org/wiki/Ghash.io#51.25_attack_controversy [1] http://gost.cypherpunks.ru/en2814789.html [2] http://gost.cypherpunks.ru/enMeshing.html [3] https://github.com/ethereum/wiki/wiki/Problems [4] https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monoculture [5] https://www.activism.net/cypherpunk/manifesto.html [6] https://en.wikipedia.org/wiki/Zcash -- Sergey Matveev (http://www.stargrave.org/) OpenPGP: CF60 E89A 5923 1E76 E263 6422 AE1A 8109 E498 57EF

9 14

Fwd: Newsletter Autistici/Inventati - Server compromessi | Breach in A/I servers
by Razer 17 Sep '17

17 Sep '17

-------- Forwarded Message -------- Subject: Newsletter Autistici/Inventati - Server compromessi | Breach in A/I servers Date: Fri, 15 Sep 2017 17:03:30 +0000 (UTC) From: Autistici/Inventati <info(a)autistici.org> Reply-To: info(a)autistici.org To: rayzer(a)riseup.net ++++++++++++++++++++++++++++++++ SERVER COMPROMESSI Niente panico, ma cambiate le password ++++++++++++++++++++++++++++++++ BREACH IN A/I SERVERS Don't panic, but change your passwords ++++++++++++++++++++++++++++++++ VIOLACION EN LOS SERVIDORES Ningun panico, pero cambia tus contrasenas ++++++++++++++++++++++++++++++++ [English version below] [Version en Espanol mas abajo] **Stai ricevendo quest'email perche' hai un account o gestisci una lista o una newsletter nei server di Autistici/Inventati** Ieri, giovedi' 14 settembre, abbiamo scoperto che qualche giorno fa l'account di un amministratore e' stato compromesso. Appena ce ne siamo resi conto, abbiamo cominciato immediatamente a lavorare per risolvere il problema. Abbiamo gia' realizzato le mitigazioni necessarie e siamo riusciti nuovamente a rimettere tutto in sicurezza. Sono ancora in corso analisi dei log e la reinstallazione dell'infrastruttura. Stiamo analizzando i dettagli della situazione per sapere esattamente che cosa e' successo. Data la natura dell'intrusione, potenzialmente tutti i dati degli utenti sono stati accessibili agli intrusi, ma al momento non abbiamo prove del fatto che siano state toccate delle caselle di posta. Come misura di sicurezza minima, dovresti cambiare tutte le tue password, e le domande di recupero dei tuoi account (email, webdav, lista di email e newsletter, noblogs.org) Ti consigliamo di usare una password forte: <https://www.autistici.org/docs/mail/passwd_safe>. Inoltre raccomandiamo sempre caldamente, se non lo hai ancora fatto, di attivare l'autenticazione a due fattori (2FA) per tenere il tuo account piu' al sicuro: <https://www.autistici.org/docs/2FA>. Nel caso l'autenticazione 2FA fosse gia' stata abilitata, dovrai resettarla, disattivandola e riattivandola. Se ne hai la possibilita', scarica sempre i messaggi di posta sul tuo computer, conservandoli con la dovuta cautela, invece di lasciarli sui nostri server. Inoltre per maggior sicurezza ricorda sempre di crittografare le tue comunicazioni: * email : <https://www.autistici.org/docs/mail/privacymail#3> * chat : <https://www.autistici.org/docs/jabber/otr> Collettivo A/I. * * * [English version] **You are receiving this email because you have an email account and/or you manage a mailing list or a newsletter on Autistici/Inventati servers** Yesterday, on Thursday 14 September, we found out that a few days ago an admin account had been compromised. As soon as we spotted this intrusion, we immediately got to work for solving the problem. We have already taken the necessary mitigation measures and have secured the machines. We are still analyzing logs and reinstalling the infrastructure. We are examining the details of the situation to figure out what happened exactly. Given the nature of this intrusion, all users' data might have potentially been accessed by the intruders, but so far we have found no evidence that someone touched the mailboxes. As a minimum security requirement, you should change all your passwords and the recovery questions for your accounts (email, webdav, mailing lists and newsletters, noblogs.org) We recommend to create strong passwords for this: <https://www.autistici.org/docs/mail/passwd_safe>. We also strongly suggest, if you haven't done so already, to activate 2-factor authentication to secure the access to your account: <https://www.autistici.org/docs/2FA>. If you have already enabled 2-factor authentication, you should reset that too, by deactivating it and activating it again. If you can, always download your email messages to your personal computer, storing them with care, instead of keeping them in our servers. Also, remember to secure your communications by encrypting them: * email : <https://www.autistici.org/docs/mail/privacymail#3> * chat : <https://ssd.eff.org/en/module/communicating-others#4> A/I Collective * * * [Espanol] **Recibes este correo porque' tienes una cuenta de correo y/o gestionas una lista de correo o una newsletter en los servidores de Autistici/Inventati** Ayer, jueves 14 de Septiembre, hemos descubierto hace unos dias que una cuenta de administracion de nuestra infraestructura habia sido violada. En cuanto nos hemos dado cuenta hemos empezado a trabajar para resolver el problema. Hemos tomados las medidas de mitigacion necesarias y hemos puesto en seguridad las maquinas. Estamos todavia analizando los logs y reinstalando la infraestructura. Estamos tambien examinando los detalles de la situacion para averiguar lo que ha ocurrido. Dada la naturaleza de la violacion, los intrusos han tenido acceso a todos los datos de los usuarios, pero en este momento no tenemos pruebas de que hayan tocado las cuentas de correo. Como medida minima de seguridad, tienes que cambiar las contrasenas y las preguntas de seguridad de todas tus cuentas (email, webdav, listas de correo y newsletters, noblogs.org) Te recomendamos de crear contrasenas fuertes: <https://ssd.eff.org/es/module/creando-contrase%C3%B1as-seguras>. Tambien te recomendamos, si no lo has hecho todavia, activar la autenticacion de dos factores (2FA): <https://www.autistici.org/docs/2FA>. Si ya tenias la autenticacion de dos factores habilitada, tendras que resetearla, deshabilitandola y volviendo a habilitarla. Si puedes, descargate siempre los mensajes de tu correo en tu ordenador personal, y guardalos con cuidado, en vez de dejarlos en nuestros servidores. Tambien recuerdate de cifrar tus comunicaciones: * correo : <https://www.autistici.org/docs/mail/privacymail#3> * chat : <https://ssd.eff.org/es/module/comunic%C3%A1ndote-con-otros> Colectivo A/I ++++ 15 September 2017 Autistici-Inventati Collective http://www.inventati.org http://www.autistici.org donate: http://www.autistici.org/donate

1 0

Fun Hardware :)
by grarpamp 16 Sep '17

16 Sep '17

On Wed, Sep 6, 2017 at 10:15 PM, Cecilia Tanaka <cecilia.tanaka(a)gmail.com> wrote: > PS for grarpamp: - "Despacito" played on two calculators, hihi! > Pretty cute and will make you smile a bit! <3 > > # https://youtu.be/gBT5lmikXrs Unboxing the "Clariton" AR-7778 Electronic Musical Calculator Complete with catchy music track https://www.youtube.com/watch?v=NBGXlxUIxuI Various models available https://world.taobao.com/item/521983057248 https://www.englishtaobao.net/Product/521983057248 https://www.amazon.co.jp/dp/B01N7GT3S2 Some tablatures for them are starting to show up. Needs a line level sub output so you can bump it. And of course, more tunes... https://www.youtube.com/channel/UCbvQHCZJHHS4PJpatQGH-0w/videos Casio and Sharp rivalry used to make similar things decades ago when pocket calculators and Japan first hit big... https://www.ebay.com/sch/i.html?_nkw=musical+calculator Related... https://www.ebay.com/sch/i.html?_nkw=nintendo+game+watch > ------- > "Don't let anyone rob you of your imagination, your creativity, or > your curiosity. It's your place in the world; it's your life. Go on > and do all you can with it, and make it the life you want to live." - > Mae Jemison

1 0

Forget populism – crypto-anarchists are the new masters
by grarpamp 15 Sep '17

15 Sep '17

https://www.theguardian.com/technology/2017/jun/04/forget-far-right-populis… Many are concerned about the internet’s role in politics. But more worrying is the digital tsunami poised to engulf us, as machine intelligence and a rising tech elite radically restructure life as we know it ......... Consider for a moment how your life has changed thanks to digital technology. You can become friends with 2 billion connected people, chose your own news, and watch/date/order whatever you want, on demand. Infinite choice and control is now the norm, and yet formal politics has barely evolved since the days of Robert Peel. Our modern political system came of age in the industrial revolution, which was a time of massive organisations and centralised control. We are now, however, firmly in a new industrial revolution, characterised by endless choice, digital technology, data, automation and artificial intelligence. The economy, identity, political allegiances, perhaps even the essence of what it is to be human, are all starting to change, and our politics will have to change with it. The current set-up, including the populist right, will cling on for a while, like a legacy IT system that’s too pricey to update, but it will shortly become redundant. Crypto-anarchy is taking over the world – millions now unwittingly rely on it for online security So what else might follow? In October last year, while researching my new book, Radicals, I was invited by a Slovenian hacker in his late 20s called Pavol to a place called Parallel Polis, a three-storey building in Prague that includes a 3D printer workshop and the “Institute of Crypto-Anarchy”. Crypto-anarchists are mostly computer-hacking, anti-state libertarians who have been kicking around the political fringes for two decades, trying to warn a mostly uninterested public about the dangers of a world where everything is connected and online. They also believe that digital technology, provided citizens are able to use encryption themselves, is the route to a stateless paradise, since it undermines government’s ability to monitor, control and tax its people. Crypto-anarchists build software – think of it as political computer code – that can protect us online. Julian Assange is a crypto-anarchist (before WikiLeaks he was an active member of the movement’s most important mailing list), and so perhaps is Edward Snowden. Once the obsessive and nerdy kids in school, they are now the ones who fix your ransomware blunder or start up unicorn tech firms. They are the sort of people who run the technology that runs the world. ..... A representative from something called “Bitnation” explained to Parallel Polis how an entire nation could one day be provided online via an uncontrollable, uncensorable digital network, where groups of citizens could club together to privately commission public services. ........... At some point, and probably sooner than we think, the current left and right offerings of the major parties, including (perhaps especially) the populist, will start to appear ludicrous and unworkable. New political movements and ideas will arrive before long for this industrial revolution, especially once the majority of the population will soon have grown up online. It will be a politics that offers solutions to the challenges society will face, and be bold enough to steer technology rather than be led by it, to harness it rather than dismiss it, to see it as a motor of social change, not just a job maker. Perhaps there will be some back-to-the-earth, off-grid thinking reminiscent of the 1970s. (There are already small hints of it if you look in the right places: bricks through Google bus windows and digital detox days). I’m not sure. More likely is that groups like the Prague crypto-anarchists, who will embrace the changes and experiment with entirely new forms of governance and society, will emerge. After all, they were right about digital technology, about surveillance and bitcoin and most of us ignored them. And for better of worse, I think they’re probably right about this too.

2 1

Re: [tor-talk] $1,000,000 for tor zerodays
by grarpamp 15 Sep '17

15 Sep '17

On Fri, Sep 15, 2017 at 5:33 AM, eric gisse <jowr.pi(a)gmail.com> wrote: > https://motherboard.vice.com/en_us/article/wnjgxb/russia-has-put-a-bounty-o… > > On Thu, Sep 14, 2017 at 5:17 PM, flipchan <flipchan(a)riseup.net> wrote: >> Where does the cash come from? Governments, Intel, LE, some corporate types, dark secrets and money. The ones, and compartmented parts of them, that need more exploits than their current, often parallel, capabilities and efforts already have. And a likely lesser set of users / devs that simply need to know [sooner]. Perhaps $1M worth bought on markets globally every month. https://en.wikipedia.org/wiki/Market_for_zero-day_exploits

1 0

Barrett Brown Pursuance Project AMA and AltGov Manifesto
by grarpamp 15 Sep '17

15 Sep '17

https://motherboard.vice.com/en_us/article/gyynwm/barrett-brown-what-is-to-… https://www.youtube.com/watch?v=SOoPyovqk2Q https://pursuanceproject.org/ It is time to consider alternate systems of governance. Impactful, agile, secure civic collaboration The Barrett Brown Review of Arts & Letters & Civil Strife is written monthly by Barrett Brown, winner of the 2016 National Magazine Award for columns and commentary. Selections... The pursuance system is the world's first comprehensive framework for process democracy. That is, it allows individuals with no prior relationship to self-organize into robust, agile entities governed via a "proceduralism of agreement." These entities, called pursuances, in turn engage and collaborate among themselves to whatever extent they choose, leading ultimately to a vast and formidable ecosystem of opposition to institutionalized injustice. Over 40 years ago, a vastly criminalized presidential administration was brought down through a combination of leaks, reporting, and Congressional action. Twenty-five years later, two former Nixon administration officials, Donald Rumsfeld and Dick Cheney, managed to take firm control of yet another presidential administration. This one, too, was marked by revelations of unconstitutional and criminal acts, including torture, mass surveillance, the unprecedented negligence of emergency preparedness functions, the politically motivated firings of U.S. attorneys, and the most disastrous military engagements since Vietnam. Ten years later, many now regard the Bush Administration with actual nostalgia. It has become more and more difficult, as the years proceed, to maintain the fiction that the American republic is fundamentally sound. An associated myth—that the great majority of the American electorate are decent people who are entirely capable of overseeing the single most powerful apparatus in history—has also become less viable. The "establishment," as we may as well join in terming it, has likewise lost credibility, for reasons ranging from nonsensical to inarguable. The end result is a crisis of moral authority, and even of amoral authority; this is a society that cannot even produce a proper strongman. But it can certainly produce a disaster, for ourselves and for the world. Recall that the baseline of 21st century America involves a sort of constitutional police state with unprecedented incarceration rates, increasingly militarized law enforcement, an unaccountable intelligence community with a long history of unconstitutional behavior, and a judicial and legislative culture that, all told, has officially rendered tens of millions of Americans criminals Rumsfeld understood the real lesson of Watergate: the risks of violating our Constitution are vastly eclipsed by the rewards. The consequences of a morally failed American republic, continuing on its present course for even just another decade, would be irreparable. No competent observer of our current trajectory can today disregard this scenario, or others far worse. Years ago, I created a group called Project PM, billed as a "distributed think tank" and intended to build a platform for vastly improved civic collaboration and media analysis. The most important fact of the 21st century is that any individual can now collaborate with any other individual on the planet. It is an absolute certainty that, with sufficient thought, a new mechanism may someday be designed, capable of integrating thousands of talented individuals and existing organizations into a sort of parallel civic ecosystem Since my release from prison eight months ago, the Pursuance System has been explained in broad terms via outlets like Wired; it will be detailed further in broadcasts by NPR, PBS, and VICE, as well as the upcoming documentary Sensational. This media push will culminate next year with the publication of my upcoming book, a "memoir-manifesto" that will make the larger case for why the Pursuance System is not only necessary, but inevitable.

3 4

Govts Feds Sponsor $1M for Tor Zerodays
by grarpamp 15 Sep '17

15 Sep '17

> On Sep 13, 2017, at 8:41 AM, I <beatthebastards(a)inbox.com> wrote: > https://zerodium.com/tor.html For more information about our tailored cybersecurity capabilities for governments or our protective solutions for corporations, please contact us. Access to ZERODIUM solutions and capabilities is highly restricted and is only available to a very limited number of eligible customers. jackieam2003 This is one of the reasons why we need tor browser to be sandboxed, it would make it much harder for an attacker to find two separate zero days, to get past both Firefox and the sandbox. That is generally Qubes+Whonix. On Thu, Sep 14, 2017 at 11:08 AM, Jim Carter <rudrajohn.rs(a)gmail.com> wrote: > Someone please take down that website. > > On Thu, Sep 14, 2017 at 10:38 AM, Lara <lara.tor(a)emails.veryspeedy.net> > wrote: > >> On Thu, 14 Sep 2017, at 04:35, krishna e bera wrote: >> > Anyone caught selling Tor bugs and exploits to anyone but TorProject >> > should be subject to some kind of severe penalty. It is an offence >> > against the right to privacy, in other words a crime against humanity. >> >> You have spoken so well, comrade! The People's Tribunals should judge >> harshly this sort of crime against our fellow comrades. And the Chief >> Administration of Corrective Labor Camps should make sure they are doing >> steady jobs to repay the public for their crimes. >> >> Than the people will need internal Passports. And should identify so the >> government will know who the criminals are. And finally everyone should >> be monitored by qualified agents to make sure nobody violates this >> sacred right to privacy. >> >> Once one single country starts doing that, more will follow. I am sure.

1 0

Godaddy survey answers
by Zenaan Harkness 15 Sep '17

15 Sep '17

Godaddy's in-house survey monkey just hit me up. Thought it was a good time to express their lack of advising themselves in regard to the impact to their public image when they took a stand against TDS: - Why did you rate Godaddy the way you just did (low)? Godaddy took a stand against freedom of speech in rejecting TheDailyStormer.com's (TDS) domain registration, and GoDaddy did so in a way which failed to uphold one of our community's foundational freedoms. When undermining a fundamental human right, as Godaddy did to TDS, even if your target is speaking objectionably, Godaddy as an "information carrier" (of sorts) has a significantly higher duty of care to its customers (e.g. TDS) than other entities. Godaddy, in cancelling TDS' domain, failed to conduct itself in a way compatible with its duty of care obligations to our community to treat every body fairly and in a way which preserves due process. Godaddy should advise itself to inform itself of the requirements for conduct in relation to those of its customers who say things on their websites which Godaddy may object to. - What is the single most important thing we could do to improve your experience? Advise yourself that when you take a public stand against freedom of speech (even objectionable speech), you are affecting your reputation negatively, in a big way. Due to the TDS episode, my plans are to transition completely off of Godaddy in the coming 2 years.

10 29

Scholarships for Security Certification
by Yush Bhardwaj 15 Sep '17

15 Sep '17

Ethical Hackers League, a nonprofit organization is offering 100% scholarships for their Certification Programs in the cyber security domain. EHL identified that there is a huge skill gap in the IT security industry and there is huge potential for aggressive expansion. With the imminent rise in cyber crime and related attacks, the need of skilled cyber security professionals is on the rise as well. This is a war one cannot fight alone and EHL is trying to solve this problem with their initiative. On its 6 year anniversary, EHL is offering 6 certifications for free every day of the year which is 365 candidates for each of the 6 programs. Even high-end advanced certifications in the domain of digital forensics are part of this scholarship program. This is a huge opportunity for those who wish to excel or build their career in IT security. To apply or for more information, please visit http://ethicalhackersleague. org or revert on this email or mail us on scholarship(a)ethicalhackersleague.org

5 5

NSA Releases Declassified CLArion, Crypto-Linguistic Association, 41 Issues, 2008-2010
by John Young 14 Sep '17

14 Sep '17

NSA Releases Declassified CLArion, Crypto-Linguistic Association, 41 Issues, 2008-2010, 280 Pages (168MB) https://cryptome.org/2017/09/nsa-clarion.zip

1 0