- cypherpunks@lists.ogf.org

projection and externalization of authority - was [zenaan@freedbms.net: Re: One-line password generator]
by Zenaan Harkness 30 Aug '17

30 Aug '17

The relevance of the following is not the crypto (I know nothing, I, know, nuszink on zis topik!), but the highlights regarding human nature to project not only authority upon external "others", but also to project one's own beliefs, or indeed even to project one's wants. That last bit (projecting one's wants) stood out to me today - an extension of the insight re projection. , ----- Forwarded message from Zenaan Harkness <zenaan(a)freedbms.net> ----- From: Zenaan Harkness <zenaan(a)freedbms.net> To: debian-user(a)lists.debian.org Date: Wed, 30 Aug 2017 11:41:03 +1000 Subject: Re: One-line password generator On Tue, Aug 29, 2017 at 02:28:01PM +0200, Thomas Schmitt wrote: > Hi, > > now it's not about information technology any more but about math and the > difficulty to properly discuss a mathematical opinion. > > > Zenaan Harkness wrote: > > Which myth? > > The one denounced by Thomas Huehn's article. That's not true. > Saying that /dev/random > gets fed directly from the entropy pool: > https://www.2uo.de/myths-about-urandom/structure-no.png WHERE in the article does he say that?!!! The article does not say that! The image might seem to suggest that. Once again: QUOTE THE ARTICLE!!! Then, QUOTE ME. Then, and only then, might you see where you are going wrong in your understanding. At the moment, what you keep doing is essentially handwaving, appealing to "the article", yet in the next paragraph denouncing (or expressing your dissatisfaction with) the article. You cannot have it both ways - as in, either you want precision in your own understanding, or you just want to hand wave about "that article" and "some cryptographers" and "what Ted Ts'o said" and what I said which you reply to. If you want to get close to understanding that which you're not understanding about cryptography, you MUST begin to be precise (no more handwaving exercises). Quote PRECISELY what someone (ANYONE!) said, and then quote, EXACTLY what an article or someone else says, that you want to compare the two statements with. Frankly Mr Thomas Schmitt, you continue to completely unfairly place a ridiculous burden upon your conversational compatriots to second- and triple- guess whatever it is that you might possibly think that you're trying to say, and further more guess and assume as to what it is you might be thinking (evidently mostly erroneously) which leads you to be trying to say whatever it is you're trying to say. Here's another homework task for you: Learn the art of axiomatic written communication. > Zenaan Harkness wrote: > > > > I should have wrote "/dev/random should be treated as though it is > > > > the input feed to /dev/urandom" (sorry about that). > > I wrote: > > > But that it isn't. The myth model says that it would be. > > > I can't see the myth in my words that you say is debunked > > The word "myth" refers to the topic and title the article, not to your words. > > I apologize for any implied belittleing of your arguments. It was not > intentional. NO! Again you are misunderstanding me - you are failing to see that I completely welcome "belittling" of my arguments - I'm not here to win any cryptography awards, and if I'm wrong, I'd much rather know about it. Please see above for my actual points that I am raising. Your lack of precise communication is completely unfair to put on others when you are wanting to gain a deeper understanding of cryptography. > > Exactly which part of my sentence above, do you say contradicts what > > you say just here? > > The part that /dev/urandom is equivalent to stemming from /dev/random. That i absolutely not what I said. > They are more or less siblings, according to Thomas Huehn and Andy Smith. He might have said that, and you seem to want them to be, but both Huehn's and Smith's position, and your apparent want, are utterly unrelated to what I said. There's a name for this technique (unintended by you I presume) which is called "projection" - you want something to be a certain way, or assume it is a certain way, and so you project upon the words of others what you believe or want to believe. This projection is what you are doing in respect of my words. It stems from a lack of precision in your communication technique, and also from putting a VERY unfair burden on your co-communication partners, and BOTH these two points demonstrate a very unfair laziness on your part - you are wanting easy answers to difficult concepts, and are relying upon whoever responds to you to try and figure out what you're thinking, assuming, projecting and misunderstanding - in the world of cryptography, that's dangerous for you if your need for cryptography is related to your safety. > > > not a strongly obfuscated but still diluted result. > > > Yes, your naivety shines through. > > I am not alone with that > > https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_… > "A CSPRNG can "stretch" the available entropy over more bits." Everyone in the world can be wrong about something, or any significant subset of the people in the world can be wrong about that thing. But this fact will never change the fact that they're still wrong about it. 1. That's wikipedia, not the bible of computational crypto. 2. The term "stretching" is a convenient metaphor. 3. To understand why "stretching" is an appropriate metaphor requires a deeper understanding of crypto than you or I seem to possess. 4. To understand why "stretching" is an inappropriate metaphor requires only to see that people keep getting lead up the garden path of colourful metaphors. > (The authors of that page throw much more math terms than have been > in this thread yet. Whether this makes them more credible stays undecided.) Their credibility is not relevant to your lack of understanding. You seem to be personally desiring the result of "some external authority I can trust" vs my preferred personal approach of "comprehend enough personally to be able to analyse what purported authorities say on the topic, so that I don't have to rely upon them." Whether I have achieved my intention is completely up for debate - I may well be utterly delusional, and frankly you ought never rely on anything I ever say, about cryptography or otherwise. I am only an authority on what I believe that I comprehend about something, and to the extent that you seek any external (to yourself) authority to "trust" in respect of computational crypography, means I must, absolutely, distance myself from you, as any reliance you put on me is a danger of liability to me. You cannot rely upon what I say about crypography, so don't even think about so relying! > Maybe the answer by Jalai in > https://crypto.stackexchange.com/questions/1740/stretching-a-random-seed-to… > points out a lower limit for the loss of entropy by exploiting the key > of a cipher. > Maybe it's a red herring. Many possibilities, and no one you can rely upon or trust about it - I suggest the only safe approach is being suspicious of anyone proclaiming authority, ESPECIALLY in respect of any matter which might effect you personally. > > This is not the place to gain a deep understanding of > > cryptographically secure random numbers > > You tell me So you say! And so you kept implying, and now you so say explicitly! > that if i read 1024 bytes from a not very secret stream that > was encrypted with a secret 384 bit key i get 1024 bytes of entropy ? You are now putting words in my mouth. You have crossed a line. Do not do this again. (The way you have done this is in a way which would undermine the separation of authority between myself, yourself, any external authority I may otherwise to choose to trust, and vice versa for yourself, were I to accept your projected assumptive authority!) Take my words as you will, but this technique is completely unacceptable to use in your conversation with me, so speak for yourself! I shall continue finish replying to this email, but you can expect less responses from me foing forward. > I'd like to read the proof for this. Whatever proof you need for your own strawmen, is a matter for you - attempting to extract things out of others in a way which they would find disrespectful if they understood what you did, is something one might consider striving to avoid. > > If you want to comprehend the significance of your naivety, find the > > number of molecules in the universe, > > What does this have to do with the question whether N bits of > information can give birth to more than N bits of information ? How do you expect to comprehend the security of any computational crypto system you choose to use ("trust") if you won't even do the most basic "cryptographic" math when it is suggested to you that doing so may well give rise within you to the understanding you purport to seek? You must begin to be comfortable in your mind with certain concepts, and the interrelation of those concepts, and thus be able to communicate with others (if that's what you want to do) by naming and comfortably relating those concepts to one another. Again, how you can you possibly gain within you the understanding you proclaim to seek, if you cannot communicate readily and freely on various --foundational-- (to cryptography) concepts? (This is an axiom of comprehension, also called a principle although the latter word is overloaded with socio psychological meanings and thus less preferable for precise communication - but hey, I might be utterly off base on my axioms, so don't trust for a minute any axiom that I present - you would merely be projecting authority upon an external source (me) and failing to know from within yourself, which (according to this incredibly humble authority) is a "dick move".) More suggested homework if you truly wish to feel comfortable with computer crypto (which, evidently it appears, you yet do not): - magnitudes - comparing magnitudes - computational difficulty - number spaces, and the magnitudes of number spaces - why cryptography relies on numeric magnitudes - what it means, computationally, to rely on a numeric magnitude - how the magnitude relied upon in the kernel random devices relates to the real world, in a way which is actually useful (this is your "atoms in the universe" homework bit) - understand the difference between the "stretching" metaphor which was provided by the kernel and other tech heads as an analogy to try to explain difficult concepts to those of us who struggle to comprehend what's involved in these algorithms - the difference between information-theoretically secure and computationally secure - the difference between theoretical and infeasible computational security (protip seach term "information theoretic") > > you're going down completely non-productive rabbit holes, > > I would like to know how one can be so sure that the holes are not > productive. Your "productivity" is a damn lazy imposition you appear to be continue putting on those other than myself who apparently wish to assist in your search for crypto understanding. > > without spending the necessary effort to learn about the maths, > > Oh. It's not the math. It's the jumps in the argumentation and the > lack of proof for strong statements. Which you will always flounder around when you have such little comprehension of the maths involved. This is what I have termed "cotton wool" thinking - where we want all our cake (the nice secure crypto in this example) AND to eat it too (in this example, to understand it to a level where we feel safe in using it, but without putting the effort in to actually bake the cake - we just want to eat it without effort). You can never have it both ways - either you learn, or you will forever continue to rely on external authorities who appear to contradict one another, and some proclaimed authorities who do contradict one another, and many (!) proclaimed authorities who simply have it wrong. > I can be convinced. Just give me links to convincing texts. You do the work - it's your journey! As I said, nothing I say can be relied upon, so there's no use me saying anything to you, unfortunately. Respectfully, Zenaan ----- End forwarded message -----

1 0

opennic is safe ?
by Yush Bhardwaj 29 Aug '17

29 Aug '17

Is this safe to use https://www.opennic.org/ and they also provide free domains which can be access only by using there nameservers. anyone have any idea about openic In reddit also posts are 2 years old Regards Yush Bhardwaj

5 7

[MINISTRY] free speech crack down continues
by Zenaan Harkness 29 Aug '17

29 Aug '17

This war against our fundamental freedoms in particular the freedom to communicate within our community, is relentless. And as in Atlas Shrugged (as poor literarily as that is), The Man is coming for you, targetting you, you personally, and no you are not "one of the good guys", you are one of targetted, one of the terrorists, no matter who you are, since this is the nature of "the beast", "evil", "the man" or whatever term you may wish to use. This targetting of the individual is achieved by all the usual means, propaganda, divide and conquer etc - and so those who today promulgate (as Razer does) "nasty free speechers who, Oh My Firetrucking God send out MEMES!!! are you f#king kidding me that's so evil they must all be immediately murdered alread", will in their turn become the targetted, since evil ultimately knows no boundaries. The fact the (((some))) of the (((exalted chosen ones))) fail to see this fundamental truth, is perhaps a little of the story which has gotten them as a tribe/group, into trouble so many times historically. Either I stand for your freedom as much as for mine, no matter how vehemently I might disagree with you, or I am sacrificing the freedom of us all, which of course must necessarily include myself. It is saddening that such basic principles are either not seen, or so easily discarded by those who boldly proclaim their "anarchist" cred. Cest la vie, fellow souls, cest la vie. Yes, yes, I know this is alsmost unfathomable to certain loud lurkers round these parts who skate the Razer's edge of incitement to murder on the streets, lambast any discussion of those "bad" facts (the ones that are less equal than others), and rail against the free speech of whichever latest group of the day opposes Antifa, but yes, this crack down will even come for you one day, Razer, and thought this may be karmically appropriate, it shall be as sad a day as today, where your opposition is being relentlessy attacked in order to stop them sending out memes. Folks, unfortunately there appears to be no easy answers except to keep striving for "more free speech" and assisting those (EVERYONE) whose free speech is being suppressed - whether that is TDS today, or Razer tomorrow. I suspect that the (((religious opposition))) to free speech shall continue, and prevail, and thus ultimately continue to exacerbate those pent up viewpoints which can explode into actual civil and/ or international war, and that in fact this is the intended outcome. Ultimately it is up to you and I to take a stand FOR our fundamental freedoms - if we don't, who will? (Certainly Razer doesn't, and won't.) Good luck all, interesting times ahead. ** Ron Paul’s “Liberty Report” being economically censored by YouTube http://theduran.com/ron-pauls-liberty-report-being-economically-censored-by… ------------------------------------------------------------ Julian Assange exposes YouTube's crack down on free speech, which now includes Ron Paul.

1 0

ACLU defended FBI similarly to how current government gets defended
by muh libre 29 Aug '17

29 Aug '17

> juan juan.g71 at gmail.com > Mon Aug 28 10:49:10 PDT 2017 > > the master race > Gentoo users ?

2 1

[MINISTRY] thought crime begets black White Spremacist: "ignore the stupid statues and stop killing each other"
by Zenaan Harkness 29 Aug '17

29 Aug '17

The "Left" destroys their own - the meltdownening continues. But at least we can certainly count on the Liberal Lefty's to proclaim free speech, uphold sensible statements from those they wanted to align with, and in general set a tone of public dialog which is the envy of the world. ... you guessed it, "or something". ** Former NBA star labeled White Supremacist for telling people to ignore “stupid statues” (Video) http://theduran.com/former-nba-star-labeled-white-supremacist-for-telling-p… ------------------------------------------------------------ Charles Barkley is being labeled a "White Supremacist" because of comments he made telling African-Americans to stop killing each other and to simply ignore all the Civil War statues. Paul Joseph Watson reports on the former NBA star urging African-Americans to concentrate on being successful, not getting angry over statues. According to left-wing website The Root, Charles Barkley is a “white supremacist” because he says black people should stop getting angry over old statues and instead concentrate on not killing each other and getting an education. “Why won’t Charles Barkley shut the fuck up?” asks a clearly triggered Michael Harriot, whose story is filed under the category “Stupid Negroes”. ... Here's a target for ya, Razer: ** Canadian PM Justin Trudeau and German FM Gabriel give fascist greeting to Ukrainian nationalists http://theduran.com/justin-trudeau-german-fm-gabriel-give-fascist-greeting-… ------------------------------------------------------------ German Twitter users in particular were incensed by Sigmar Gabriel's lack of sensitivity to the victims of fascism. We "know for sure man, for sure" that the USA would -never- have insisted on unfair oil trade for debt deals and in any case, Venezuela would -never- have accepted such stupid bankrupting-the- country arrangements decades ago, and so the USA/CIA/Zio-state would -never- consider war against Venezuela to "double down" on its outstanding "debt instrument obligations" as an excuse to try to bring Venezuela into their preferred (((One World USD banking system))) ... ... surely not? ** VENEZUELAN FM: Country ready for war–insistent on peace http://theduran.com/venezuelan-fm-country-ready-war/ ------------------------------------------------------------ Foreign Minister Jorge Arreaza spoke with RT after his private meeting with UN Secretary General António Guterres. This one's just pure mystery folks - it is inconceivable that the USA would want endless war - that would be something like Ministry propaganda straight out of 1984 yo! Could never happen, so if folks start talking such shit, (((Shut it Down!))) since it can be nothing but a brutal fascist war-hating, MIC-hating, (((BIS-hating))) lie: ** Did you know the Taliban tried to surrender to the United States only to be rebuffed? http://theduran.com/did-you-know-the-taliban-tried-to-surrender-to-the-unit… ------------------------------------------------------------ Taliban surrendered to US multiple times and the US rebuffed them.

2 1

The best way to beat an Ashkenazi (White Nationalist edition)
by Yt 28 Aug '17

28 Aug '17

> Steve Kinney admin at pilobilus.net > Sun Aug 20 12:30:24 PDT 2017 > > The most Aryan looking person I ever met > You've never met an Iranian/Persian, then, you uneducated racist. > the losing team > Globalism/Communism ? Or do you mean Privacy/Freedom ? Pic related. > You > Nazi/KKK > Funny, how I never mentioned these groups, and am an Ashkenazi Jew. You must be projecting. > the Juggalos > Are anti-commie and in support of a future for their children. Only LE assets like edgynameanon and brainwashed leftists like you will be acting against the interest of nationalism, which seeks to preserve your freedoms, and stomping on whatever dribble of liberty remains. You have fallen right into our trap. We have intentionally muddied nationalist sentiments by false flagging the Third Reich at every chance we get using lesser Jews such as Richard Spencer and Milo Yiannopoulos to stir the pot. This is the end for your precious freedoms. You bought all of our revisions and repossessions. The surveillance state is growing with every protest and we even have leftists demanding censorship under the guise of ending "hate", an actual human emotion, just look at this Tor Project ticket: trac.torproject.org/projects/tor/ticket/23270 We have turned you against your own self-interests by convincing you that your Aryan brothers and sisters are actual "Nazis" and that they seek to remove your freedoms and, taking the bait, you have yourselves removed those exact freedoms we warned the "Nazis" were after. Once we convince enough people that the USA was founded on slavery, and that "whites", not Jews, were the slave owners and traders, the golem will finally remove the Aryan from power and the country can outwardly begin the shift to a New Greater Israel.

2 2

ACLU defended FBI similarly to how current government gets defended
by Ryan Carboni 28 Aug '17

28 Aug '17

http://www.columbia.edu/cu/lweb/digital/collections/rbml/lehman/pdfs/0279/l… "Why was Mr. Hoover opposing a law which would make his own work much easier?" wow I guess those folks in charge aren't so bad, they they uh, they make their own jobs more difficult, so they really good guys huh

3 2

Use of Stringray requires warrant...sometimes.
by jim bell 27 Aug '17

27 Aug '17

https://arstechnica.com/tech-policy/2017/08/court-locating-suspect-via-stin… [extended quote follows] A federal judge in Oakland, California has ruled against the suppression of evidence derived from warrantless use of a cell-site simulator. The simulator, a device often referred to as a stingray, was used to locate the lead defendant in an ongoing attempted murder case. In the 39-page ruling, US District Judge Phyllis Hamilton notably found that the use of stingray to find a man named Purvis Ellis was a "search" under the Fourth Amendment—and therefore required a warrant. However, in this case, the judge also agreed with the government’s assertion that there were exigent circumstances, along with the "good faith exception" to the warrant requirement. In other words, use of the stingray was wholly justified. "Cell phone users have an expectation of privacy in their cell phone location in real time and that society is prepared to recognize that expectation as reasonable," Judge Hamilton wrote, citing an important Supreme Court decision from 1967 known as United States v. Katz. But because Ellis was believed to be involved in another shooting that happened one day earlier on January 20, 2013, the judge felt there were exigent circumstances. "Though Ellis was not known to be the shooter, he was believed to be a suspect in possession of firearms," Judge Hamilton continued. "The need to prevent escape by a suspect presented exigent circumstances here." "Exigent circumstances" is the idea in American criminal procedure that law enforcement can search or seize persons or things if there are imminent circumstances where bodily harm or injury is in process, evidence is being destroyed, or a suspect is in flight. In such situations, a warrant is not required. Warrants required since 2015 anyway Thursday’s court order could provide a new incentive for a guilty plea for Ellis, who was located in an East Oakland apartment building by the FBI and the Oakland Police Department several hours after the January 21, 2013 shooting of a non-uniformed OPD officer. Three other men were charged in the case, although one of them pleaded guilty earlier this year. No trial date has been set.FURTHER READINGLawyer: Cops “deliberately misled” judge who seemingly signed off on stingrayEllis’ attorney, Martha Boersch, did not immediately respond to Ars’ request for comment. As Ars has been reporting for years, Ellis has provided rare insight into stingrays are used in practice to find suspects and the seeming lengths the government is willing to go to keep usage quiet. The surveillance tool has come under increasing scrutiny by lawmakers and activists in recent years. Since this case began, both the Department of Justice, which oversees the FBI, and the State of California now require a warrantwhen a stingray is used in most circumstances. Riana Pfefferkorn, a lawyer affiliated with the Stanford Center for Internet and Society, said that the judge’s ruling was "careful," but she noted that it may not specifically matter, given that both state and federal policy has changed since Ellis and his co-defendants were arrested in 2013. "This is resolving something that happened over four years ago where on a going forward basis it may be a moot point," she told Ars.FURTHER READING“PING SUSP PHONE”—An Oakland shooting reveals how cops snoop on cell phonesWhen this case first began unfolding in federal court four years ago, prosecutors insisted that only one stingray was used. It turned out that there had been two—one first by the OPD, followed by another belonging to the FBI. The entire issue as to what level of privacy a person can expect over their location information, and what hurdles law enforcement must jump through to obtain it (through a stingray or other means), are still up for discussion. A related case, United States v. Carpenter, is pending before the Supreme Court. In Carpenter, the court is being asked whether law enforcement needed a warrant to obtain over 120 days of cell-site location information (CSLI), or whether a lesser standard was sufficient. "The court's search analysis is based heavily on that one district's CSLI cases, which conflict with other circuits' rulings on CLSI and are going to be decided soon by the Supreme Court anyway," Orin Kerr, a law professor at George Washington University, told Ars. "Given that the constitutional analysis is largely based on issues the Supreme Court is about to revisit, it's not obvious that Ellis will have much influence on its own." [end of extended quote]

1 0

rowhammer for flash storage
by Georgi Guninski 27 Aug '17

27 Aug '17

The hardware is buggy, the software is buggy, users are buggy. They convince you the combination is "secure". https://www.theregister.co.uk/2017/08/17/rowhammer_for_nand_flash/ Rowhammer RAM attack adapted to hit flash storage

2 1

WiFi-Aware / Neighbor Awareness Networking
by grarpamp 26 Aug '17

26 Aug '17

> I can see some privacy concerns with this stuff. > I was wondering what you all thought. https://www.wi-fi.org/discover-wi-fi/wi-fi-aware https://youtu.be/xwSYPqqhTsQ https://en.wikipedia.org/wiki/Wi-Fi_Alliance#Wi-Fi_Direct https://en.wikipedia.org/wiki/Proximity_marketing http://www.theregister.co.uk/2015/07/15/wifi_alliance_ushers_in_new_era_of_… https://techcrunch.com/2015/07/14/wi-fi-aware-aims-to-connect-all-your-devi… http://thehackernews.com/2017/08/android-8-oreo.html https://www.android.com/versions/oreo-8-0/ https://developer.android.com/about/versions/oreo/index.html https://developer.android.com/guide/topics/connectivity/wifi-aware.html Traditionally, we'd build a decentralized anonymous p2p location enabled network app for this, potentially filtering or segmenting millions of nodes around the globe for scaleability by distance metrics. That's still a much needed app, but they typically design and operate globally before locally. WiFi Aware interfaces local before global, specifically within wifi range. People who... are open to chat, like this or that interest, are single and looking, have cryptocurrencies to trade, need help, etc. Further, opensource apps can utilize the WF-A API so you don't need to use all the closed ad/pay shitware that's about to explode onto scene. You can seed WF-A app data into the above decentral app tools. Overall, it's powerful and useful tech. Privacy is as usual... - Up to you (or the closedsource shit you foolishly continue to insist on supporting with your dollars, voice, usage and stupidity). - Depends on security, design model, options and features of the entire stack Also, so long as you have wifi hardware that can tx / rx raw frames, you could develop your own opensource "wifi-aware" network protocols in software. Closed WiFi Alliance crap not needed. A couple groups were working on opensource wifi firmwares. And RTL SDR groups are doing wifi completely opensource.

1 0