- cypherpunks@lists.ogf.org

[SlightlyAboveMyPaygrade] The problems with encryption on Android
by Razer 16 Aug '17

16 Aug '17

> > The limitations of Android N Encryption > > Over the past few years pixelphonewe’ve heard more about smartphone > encryption than, quite frankly, most of us expected to hear in a > lifetime. We learned that proper encryption can slow down even > sophisticated decryption attempts if done correctly. We’ve also > learned that incorrect implementations can undo most of that security. > > In other words, phone encryption is an area where details matter. For > the past few weeks I’ve been looking a bit at Android Nougat’s new > file-based encryption to see how well they’ve addressed some of those > details in their latest release. The answer, unfortunately, is that > there’s still lots of work to do. In this post I’m going to talk about > a bit of that. > > (As an aside: the inspiration for this post comes from Grugq, who has > been loudly and angrily trying to work through these kinks to develop > a secure Android phone. So credit where credit is due.) > > Background: file and disk encryption > > Disk encryption is much older than smartphones. Indeed, early > encrypting filesystems date back at least to the early 1990s and > proprietary implementations may go back before that. Even in the > relatively new area of PCs operating systems, disk encryption has been > a built-in feature since the early 2000s. > > The typical PC disk encryption system operates as follows. At boot > time you enter a password. This is fed through a key derivation > function to derive a cryptographic key. If a hardware co-processor is > available (e.g., a TPM), your key is further strengthened by > “tangling” it with some secrets stored in the hardware. This helps to > lock encryption to a particular device. > > The actual encryption can be done in one of two different ways: > > Full Disk Encryption (FDE) systems (like Truecrypt, BitLocker and > FileVault) encrypt disks at the level of disk sectors. This is an > all-or-nothing approach, since the encryption drivers won’t > necessarily have any idea what files those sectors represent. At the > same time, FDE is popular — mainly because it’s extremely easy to > implement. > File-based Encryption (FBE) systems (like EncFS and eCryptFS) > encrypt individual files. This approach requires changes to the > filesystem itself, but has the benefit of allowing fine grained access > controls where individual files are encrypted using different keys. > > Most commercial PC disk encryption software has historically opted to > use the full-disk encryption (FDE) approach. Mostly this is just a > matter of expediency: FDE is just significantly easier to implement. > But philosophically, it also reflects a particular view of what disk > encryption was meant to accomplish. > > In this view, encryption is an all-or-nothing proposition. Your > machine is either on or off; accessible or inaccessible. As long as > you make sure to have your laptop stolen only when it’s off, disk > encryption will keep you perfectly safe. > > So what does this have to do with Android? > Find out, with links: https://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/

2 1

Re: Chilling Dissent: The Just-Us Dept Fights DreamHost for Trump Protest site disruptj20.org Info
by jim bell 16 Aug '17

16 Aug '17

From: Razer <g2s(a)riseup.net> Lawfare. Links on-site: > > The Justice Department is fighting for information on all of the > visitors to the website disruptj20.org, as well as log files on when > and from where the visitors logged onto the site, what they looked at, > and emails related to the site. The site at the center of the storm > bills itself as a platform connecting Trump protesters and > "support[ing] the massive and spontaneous eruption of resistance > across the United States that’s happened since the election." > > At the New York Times, Charlie Savage reports that federal > investigators have issued a search warrant to the internet hosting > company DreamHost, which is now challenging the warrant as > unconstitutionally broad—complying with it would allegedly require > handing over 1.3 million visitor IP addresses and the information, > emails and photos of thousands of users. Also see the Washington Post > story last night from Ellen Nakashima. [...]> https://lawfareblog.com/justice-department-fights-web-hosting-company-trump… When police or prosecutors are seeking a search warrant, the usual procedure is for them to prepare a document, which is called a "warrant affidavit", which is supposed to contain sufficient facts and argument to justify a judge granting the warrant. This document is presented to a judge who considers it, and either grants or denies the warrant.Warrant affidavits are usually secret before a warrant is granted, although sometimes they may no longer be secret after the warrant is served. The affidavit document is what you want to see to find out why they wanted a warrant in the first place. This is a discussion of the warrant: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/15/a-close… This seems to be the warrant itself: https://www.dreamhost.com/blog/wp-content/uploads/2017/08/DH-Search-Warrant… It refers to an affidavit, "D2-1645". When combined with "dreamhost, a top google-search result ('D2-1645 dreamhost") is: https://www.eff.org/files/2017/08/14/2017.07.28_motion_for_dreamhost_to_sho… This statement says that the affidavit is sealed (meaning secret). "At the center of the requests is disruptj20.org, a website that organized participants of political protests against the current United States administration. While we have no insight into the affidavit for the search warrant (those records are sealed), the DOJ has recently asked DreamHost to provide allinformation available to us about this website, its owner, and, more importantly, its visitors." Jim "Perry Mason" Bell https://www.youtube.com/watch?v=ZnuJVWdQk9w

1 0

Peak freedom from Political Correctness has been reached - [ PFKR ] Wow': Stunned TV Hosts Reacted in Real Time to Trump
by Zenaan Harkness 16 Aug '17

16 Aug '17

This is a moment in time that shall go down in history, folks. As said a ways back, the multi billion dollar CNN corporation single handedly busted history's most severe levels of "only ever raise politically correct, non-Jewish related questions, now" social domination of the West, simultaneously restarting the public discourse on that very J (and very Q) "JQ" - aka The Jewish Question. <snigger> Evidently Fox News wants in on the Good Times :D Especially this nugget, from Fox News' "The Specialists" host, Guy Benson, talking about the recent huwaite march in Charlottseville: "They were chanting things like, 'Jews will not replace us,'" Mr. Benson said. "There's nothing good about that." ( In the immortal words of a grinning Kek: "That's where you're wrong, kiddo :)" ) So, ask Arch-Angel Gabriel, Mr Benson, or ponder the meta cycles arising from the shibboleth, and perhaps wisdom shall dawn - unlikely, but possible nonetheless. What a gas, as they say ... ----- Forwarded message from "PFKR", aka The Kangz ----- Wow': Stunned TV Hosts Reacted in Real Time to Trump https://www.nytimes.com/2017/08/15/business/media/wow-stunned-tv-hosts-reac… On Fox News, normally a redoubt of Trump support, the 5 p.m. co-hosts of "The Specialists" shook their heads, with the anchor Guy Benson saying that Mr. Trump "lost me" when he insisted that some "very fine people" participated in the white supremacist rally. "They were chanting things like, 'Jews will not replace us,'" Mr. Benson said. "There's nothing good about that." His co-host, Ms. Timpf, a libertarian pundit who contributes to National Review Online, exhaled deeply. "It was one of the biggest messes that I've ever seen," she said. "I can't believe it happened." Disbelief also dominated the early reaction on MSNBC and CNN, where Mr. Tapper ended his afternoon show by directly addressing viewers. - - - --Lauren-- Lauren Kangztein (lauren(a)kangz.com) https://www.kangz.com/laurenk ----- End forwarded message -----

1 0

The masochist says “Beat me!” … from Defending People and My Regal Liege
by Zenaan Harkness 15 Aug '17

15 Aug '17

Someone's finally done a blog on spending/ valuing ones own attention - and nailed it! Enjoy :) The masochist says “Beat me!” … August 14, 2017 By Mark Bennett … and the sadist says “No.” http://blog.bennettandbennett.com/2017/08/the-masochist-says-beat-me/

1 0

Closing, but not closing, Sec. 702’s Backdoor Search Loophole
by Razer 15 Aug '17

15 Aug '17

> > With less than five months to go until Section 702 of the Foreign > Intelligence Surveillance Act (FISA) expires, we still do not have a > clear path forward to a reauthorization that would also address the > law’s substantial problems. A major reason for this is an impasse on > what to do about the law’s most significant flaw: that it permits the > government to seek out the content of Americans’ communications that > have been swept up through Section 702 without any suspicion of > wrongdoing, let alone a warrant, a problem known as “the backdoor > search loophole.” Unfortunately, opponents of reforming the loophole > have either failed to understand how the proposed fix to the loophole > would actually work, or are describing it inaccurately in an effort to > discredit reform. > > A common critique of the fix has recently come forward. It wrongly > argues that closing backdoor search loophole would require a probable > cause warrant to access any information about Americans... > > [...] > > Yes, the most important part of the fix is to require a probable cause > warrant to review content—the same obligation that exists in every > other situation where the government deliberately seeks out the > content of an American’s communications. But the reform proposal for > years does not impose that requirement for other types of Section 702 > data queries. > > Most notably, the text of amendments to close the loophole that were > introduced by Reps. Thomas Massie (R-Ky) and Zoe Lofgren (D-Calif.) in > 2014, 2015, and 2016 permit queries as authorized under all provisions > of FISA and Title 18 of the US Code (domestic law enforcement > surveillance provisions). This means that metadata searches that > examine, for example, who someone has been corresponding with but not > what they have said, can be conducted pursuant to the lower relevance > standard – whereby government must simply show that the information > sought could aid in furtherance of an investigation – permitted under > FISA Pen/Trap laws and Section 215 of the PATRIOT Act, both of which > are explicitly included in the reform language. In full with links, Just Security: https://www.justsecurity.org/44125/opponents-closing-backdoor-search-loopho…

1 0

[RUS] Ukraine - former OSCE rep reveals all: eye witness report + interview
by Zenaan Harkness 15 Aug '17

15 Aug '17

>From the coal face. Exclusive Interview: former OSCE representative reveals all http://www.fort-russ.com/2017/08/exclusive-interview-former-osce.html

1 0

ROTF! The Daily Stormer needs to find another DNS!
by Razer 15 Aug '17

15 Aug '17

Hate speech. Maybe it can settle into Cloudflare. Considering the US government is Fascist with serious Nazi tendencies and has been for a long, long time, it's unlikely the NSA will honeypot it... Unless they think they can do some good recruiting. http://www.cnn.com/2017/08/14/us/godaddy-daily-stormer-website-trnd/index.h… > > "We have informed The Daily Stormer that they have 24 hours to move > the domain to another provider, as they have violated our terms of > service. If no action is taken after 24 hours, we will cancel the > service," GoDaddy spokesman Dan Race told CNN in a statement. > > "Given their latest article comes on the immediate heels of a violent > act, we believe this type of article could incite additional violence, > which violates our terms of service." > > An article posted on the Daily Stormer called Heyer "fat and a drain > on society." > > "Despite feigned outrage by the media, most people are glad she is > dead, as she is the definition of uselessness," the story said. "A > 32-year-old woman without children is a burden on society and has no > value." > Sounds like Nazis to me. Or rabid settler Zionists contemplating the comparative value of their fingernails and Palestinian lives. Rr

5 10

[vanity post] A whole new meaning to 'Rr'
by Leigh Meyers 14 Aug '17

14 Aug '17

> Redneck Revolt is a national network of community defense projects > from a broad spread of political, religious, and cultural backgrounds. > It is a pro-worker, anti-racist organization that focuses on working > class liberation from the oppressive systems which dominate our lives. > In states where it is legal to practice armed community defense, many > branches choose to become John Brown Gun Clubs, training ourselves and > our communities in defense and mutual aid. > > This project was founded in June 2016, by several members of previous > similar community defense formations in Kansas and Colorado. We have > 30+ vetted branches, united under our common goals as outlined in our > principles, and organized through a collaboratively built national > network. https://www.redneckrevolt.org/ Rr Ps. The 60s. "Rising Up Angry", Radical 'Greasers' https://en.wikipedia.org/wiki/Rising_Up_Angry

5 12

part 3 -- Propaganda 1-0-1 - [pfkr@pfkr.org: [ PFKR ] Female employee on the Google memo: 'I don't know how we could feel anything but attacked by that']
by Zenaan Harkness 14 Aug '17

14 Aug '17

Classic Lefty propaganda parades itself for our analytical pleasure :) Liberal Lefty propaganda hit squad mug shots, exposing themselves in all their factless feely fuhrenlugenlumpenessenen inglory: - "the infamous memo" is only ever alluded to, never quoted quoting the source would of course despose the lie exposed in reposing factual prose - clever rhetoric effectively disguising the lack of any critical/constructive analysis of the memo itself whatsoever, and thereby short ciruiting all rational, critical debate e.g.: "You've read the memo, right?" - feelings are the only significant things, and all feelings are facts, and the world must revolve around feelings, e.g.: "Yesterday the women in the Ads group got together ... listening session ... and it's hard to not feel like that's an attack on you personally" and more tear jerkingly beautiful morono propo ganda: "Steve Kovach: Why did you want to talk to me? Lauren: Mainly because I felt like no one was asking the women of Google how they felt" And the joy turns ecstatic as we realise that, instead of actually responding to any (as in ANY) of the claims made by Damore in his 10-page memo (plenty of quotable material in that 10 pages too), this Lauren woman then goes on to -complain- that: "What about all the women? ... no one is asking us to respond to the claims that he made about us" - classic faux empathy/ pretend group-alignment e.g.: “Look, I’m a conservative. I completely disagree with everything he said, but I’m still a conservative. which is beautifully preceeded with this psychobabble pre-seeding nugget: "Can Google do a better job at making conservatives in the company feel like they can voice their views? (Yes.)" Very impressive, BussinessInsider.comm, very impressive! - implying facts from the --completely unquoted-- source, whilst twisting what was said into a 180° opposite meaning (by implication), e.g.: "But to have us all lumped into one sort of category like that" - At least one of the big-bold header bylines expresses some honesty, if you can read it right: "A female Google employee named Lauren tells Business Insider that most of the attention surrounding James Damore’s memo has nothing to do with how women inside the company feel." which actually means "A female Google employee named Lauren tells Business Insider that most of the attention surrounding James Damore’s memo has nothing to do with how women inside the company feel ... and dang it, we should all focus on how us women feel already - how dare everybody focus on the content of the memo and what its author actually wrote! We have FEELINGS and we WILL be head for many many hours about our feelings because its all just not OK!" - more big bold header byline goodness: "Lauren says she feels like she’s had great opportunities within Google, and has received support from leaders life CEO Sundar Pichai and CFO Ruth Porat." Yes, yes I'm sure you don't want to lose Mr Sookysooky as you "cry-in-Tuesdays CEO of the century", so suck up good and proper, give Google a feel-good and hopefully the feel-good will continue; don't want to losse a Sookysook CEO now. - some beautiful fact-free reader impact targetting: "But the impact on the group targeted in the memo has been largely ignored." This is seriously some fine psychological propaganda - if "why it's propaganda" does not quite add up for you, just go read James "Damore CoC, da worse it gets" Damore's original, actual memo, then re-read this article to see how (really) quite sophisticated this Bu$$ine$$In$ider.comm article really is... - evident butt covering and "just in case you were at all concerned" this really IS propaganda disclaimer: "had approval from Google to speak to the press" This one's actually a double-whammy for the cotton-wool children of Gen-XYZ, since it subtly reinforces the --- externalisation of authority --- "oh it's all ok here, talking about our feelings, ignoring the facts, and even utterly misrepresenting the original source - it's all ok see, because this talking lady HAS AUTHORITY FROM GOOGLE to talk publicly". Just as well she GOT AUTHORITY FROM GOOGLE BEFORE SHE TALKED PUBLICLY! Shit, she might have caused a real PR disaster otherwise :) - classic fear indoctrination: "but I’m only using her first name because many of her colleagues have been outed on fringe websites, raising safety concerns" - more fear, but more importantly, some post-facto justification for Sookysooky's "internal Google `Town Hall`" cancellation: "In fact, it was the safety issue that caused CEO Sundar Pichai to cancel a town hall meeting Thursday that was supposed to answer questions about Damore’s memo" - and the embarrassing truth of Google's first cry-in on this issue is thankfully exposed in full plainality: "Kovach: What came out of that session? Lauren: There was no agenda." Hmm ... perfectly clear I must say, perfectly clear there Lauren :) And so it goes and on it goes ... worth reading in its entirety as a reminder of classic Lefty group think - I'm barely 1/4 the way through, but I think the gist of this cry-in is entirely evident - Juan would surely be proud of 'em :D :) Z PS: Evidently, Pichai Sookysookysundarajanandanan has lifted his game ... not. Perhaps this an appropriate nick for him - Sookysookanan, the world's most overly paid sooky sook pretending to be a CEO. Oh well, evidently Google can afford such indulgences... ----- Forwarded message from "PFKR (People For Kangz Responsibility) Announcement List" <pfkr(a)pfkr.org> ----- Date: Sun, 13 Aug 2017 19:50:29 -0700 Female employee on the Google memo: 'I don't know how we could feel anything but attacked by that' http://www.businessinsider.com/female-google-employee-responds-to-james-dam… "You've read the memo, right? I'm not a female engineer, but I've talked to a lot of female engineers. Yesterday the women in the Ads group got together with one of the directors of engineering. She organized a sort of listening session and we kind of all just sat down and talked about it. I think it's just really hard to have someone make baseless claims about your abilities in the workplace, and I think that's what happened. And it's hard to not feel like that's an attack on you personally, and on us collectively. We talk a lot about how women at Google are a minority. We're not a minority [outside of Google], but we kind of are [inside]. But to have us all lumped into one sort of category like that and to have such a baseless claim made about who we are, and to have it positioned as fact -- as scientific fact -- I don't know how we could feel anything but attacked by that." - - - --Lauren-- Lauren Weinstein (lauren(a)kangz.com) https://www.kangz.com/lauren Co-Founder: People For Kangz Responsibility: https://www.kangz.org/pfkr-info --- Impeach Trump cuz """"DUMOCRACY"""" --- _______________________________________________ pfkr mailing list https://lists.kangz.org/mailman/listinfo/pfir ----- End forwarded message -----

1 1

Google totally incompetent, could prevent a class of phishing with simple regex
by Ryan Carboni 13 Aug '17

13 Aug '17

Quite a few phishing attacks involve accounts with "noreply" in the name. So. Block registration of accounts with noreply and inspect currently existing noreply accounts. https://cdn01.theintercept.com/wp-uploads/sites/1/2017/06/nsa-russia-hackin… ~~ i can run a multi-billion dollar corporation better than the current lot ~~ it doesn't protect against protocol design issues https://www.reddit.com/r/sysadmin/comments/3xiam3/how_are_we_supposed_to_st… but well Snowden leaked information about a backdoored cipher, so everything else must be fine. DUAL_EC_DRBG wasn't used by anyone right?

1 0