- cypherpunks@lists.ogf.org

CrimethInc Ex-Workers Collective: Do the Vault7 Revelations Mean Encryption Is Useless?
by Razer 09 Mar '17

09 Mar '17

End-to-End Encryption 101 : And do the Vault 7 Revelations Mean Encryption Is Useless? By CrimethInc. Ex-Workers Collective - March 8, 2017 If you’ve used the internet at any point since May 2013, you’ve probably heard that you should use encrypted communications. Edward Snowden’s revelation that the National Security Agency logs all of our calls, texts, and emails sparked a surge in the development and use of encryption apps and services. Only a few years later, encryption is widely used for daily communication. If you use any of these encryption tools, you’ve probably also heard the phrase “end-to-end encryption,” or “E2EE.” The name seems straightforward enough: end-to-end means content is encrypted from one endpoint (generally your phone or computer) to another endpoint (the phone or computer of your message’s intended recipient). But what level of security does this promise for you, the user? Since the start of Trump administration, the US Customs and Border Protection (CBP) has increased its invasion of travelers’ privacy. The CBP has been demanding that both US citizens and visitors log into their phones and laptops and hand them over to the CBP for inspection. They’ve also demanded that travelers provide their passwords or log in their social media accounts. Travelers who don’t comply face the threat of being denied entry. Yesterday, Wikileaks publish a trove of leaked CIA documents including knowledge of security vulnerabilities and exploits that the CIA paid for and kept secret from the general public. Now that this information has leaked, it’s no longer just the CIA that knows these vulnerabilities—it’s everyone. The New York Times and others misreported that the CIA had broken the encryption in apps like Signal and WhatsApp, when in fact what the CIA did was target specific people’s Android devices and compromise them. In short, this revelation confirms the importance of using end-to-end encrypted communications, which hinder state-level actors from performing broad spectrum dragnet surveillance. E2EE is still important. > Many reports around Vault 7 have given the impression that > encrypted apps like Signal have been compromised. In fact, the > compromise is at the device level—at the endpoint. There is no reason > to believe the encryption itself does not work. Limitations: Plaintext Endpoints First, it’s important to understand that if you can read a message, it is plaintext—that is, no longer encrypted. With end-to-end encryption, the weak links in the security chain become you and your device, and your recipient and their device. If your recipient can read your message, anyone with access to their device can also read it. An undercover cop could read your message over your recipient’s shoulder, or the police could confiscate your recipient’s device and crack it open. If there is any risk of either of these unfortunate events taking place, you should think twice before sending anything you wouldn’t want to share with the authorities. This particular limitation is also relevant to the recent “Vault 7” reveals, which demonstrate how apps like Signal, WhatsApp, and Telegram may not be useful if an adversary (like the CIA) gains physical access to your device or your contact’s device and is able to unlock it. Many reports around Vault 7 have been somewhat misleading, giving the impression that the apps themselves have been compromised. In this case, the compromise is at the device level—at the endpoint. The encryption itself is still good. Limitations: Targeted Surveillance Considering that you can’t control the level of security of your message’s recipient, you should consider the risk that any message you send them might be read. While rare, there are cases of state powers targeting people with direct surveillance. In these cases, targets may be working with malware-infected devices intended to log all of their incoming and outgoing communications. This compromise functions at the endpoint level, rendering E2EE useless against these specific adversaries. Because it is difficult to know whether you (or your message recipient) are the target of this type of attack, it is always best to default to not sending overly-sensitive information via digital communications. Currently, such attacks appear to be rare, but one should never take risks needlessly. Limitations: Metadata The third thing you should know about E2EE is that it doesn’t necessarily protect your metadata. Depending on how communications are transmitted, logs may still show the time and size of communication, as well as the sender and recipient. Logs may also show the location of both sender and recipient at the time of communication. While this is not typically enough to land someone in jail on its own, it can be useful in proving associations between people, establishing proximity to crime scenes, and tracking communication patterns. All these pieces of information are useful in establishing larger behavioral patterns in cases of direct surveillance. So… Why? So, if end-to-end encryption doesn’t necessarily protect the content of your communications, and still gives up useful metadata, what’s the point of using it? One of the most important things E2EE does is ensure that your data never hits someone else’s servers in a readable form. Since end-to-end encryption starts from the moment you hit “send” and persists until it hits your recipient’s device, when a company—like Facebook—is subpoenaed for your logged communications, they do not have any plaintext content to give up. This puts the authorities in a position in which if they wish to acquire the content of your communications, they are forced to spend a significant amount of time and resources attempting to break the encryption. In the United States, your right to a speedy trial may render this evidence useless to prosecutors, who may not be able to decrypt it quickly enough to please a judge. Mass Surveillance Another use of E2EE serves is to make dragnet surveillance by the National Security Agency and other law enforcement agencies much more difficult. Since there is no point in the middle at which your unencrypted communications can be grabbed, what is grabbed instead is the same encrypted blocks of text available by subpoena. Dragnet surveillance is generally conducted by collecting any available data and subjecting it to automated sorting rather than individual analysis. The use of encryption prevents algorithmic sifting for content, thus making this process much more difficult and generally not worthwhile. Stingrays In addition to NSA’s data collection, federal and state law enforcement agencies around the country have, and frequently use, cell site simulators known as “IMSI catchers” or “Stingrays.” IMSI catchers pretend to be cell towers in order to trick your phone into giving up identifying information, including your location. Cell site simulators also grab and log your communications. As with other methods of interception, encryption means that what is retrieved is largely useless, unless the law enforcement agency is willing to go to the trouble to decrypt it. Encryption At Rest In addition to using end-to-end encryption to protect the content of your messages while they’re being sent, you can use full-disk encryption to protect your information while it’s stored on your device. Proper full-disk encryption means that all of the information on your device is indecipherable without your encryption key (usually a passphrase), creating a hardened endpoint which is much more difficult to compromise. Although encrypting your endpoints is not necessarily protection against some of the more insidious methods of surveillance, such as malware, it can prevent adversaries who gain possession of your devices from pulling any useful data off of them. End-to-end encryption is by no means a magical shield against surveillance by nation states or malicious individuals, but Vault 7 highlights how using it can help force a procedural shift from dragnet surveillance to resource-intensive targeted attacks. When paired with good sense, encrypted devices, and other security practices, E2EE can be a powerful tool for significantly reducing your attack surface. Consistent, habitual use of end-to-end encryption can nullify many lower-tier threats and may even cause some higher-level adversaries to decide that attacking you is simply not worth the effort. --33-- https://itsgoingdown.org/end-end-encryption-101-vault-7-revelations-mean-en…

1 0

NY Post: WikiLeaks takes another shot at America
by jim bell 09 Mar '17

09 Mar '17

Note:. I, Jim bell, think the content of this editorial is utter nonsense. But, "Know thine enemy" WikiLeaks takes another shot at America http://nyp.st/2n7Robo

1 0

happy 8 march to the women
by Georgi Guninski 08 Mar '17

08 Mar '17

happy 8 march to the women

4 3

NY Post: Encryption is hindering FBI's crime-fighting efforts: Comey
by jim bell 08 Mar '17

08 Mar '17

Encryption is hindering FBI's crime-fighting efforts: Comey http://nyp.st/2mYYOkm

1 0

[TriggerWarning: Sexist-Racist-Baiting, cmon...] Selma Burke
by Razer 08 Mar '17

08 Mar '17

You know... THAT "Selma Burke". The Black Woman who never received credit for her portrait of Franklin D, Roosevelt on the US dime. https://twitter.com/Crystal1Johnson/status/838140498841763840 Rr

5 18

Claims begin to surface that Signal, etc not compromised by CIA ZeroDay
by Razer 08 Mar '17

08 Mar '17

From a DailyDot 'staff writer'. > Unfortunate that poorly written explainations by WikiLeaks & NYTimes > forced so many reporters to waste time clarifying this today. DailyDot and Wikileaks aren't exactly on friendly terms because the Dot fronted the cold war trope for US interests that Wikileaks redacted Syria papers about Russian involvement. http://www.theverge.com/2016/9/9/12864328/wikileaks-threat-reporters-syria-… Thread: https://twitter.com/dellcam/status/839280333732315136

2 1

Re: [Cryptography] Crypto best practices
by Ryan Carboni 08 Mar '17

08 Mar '17

Wait, AES with a minimum of 256 bits? Might be a typo, but there's only one AEAD AES with no more than 256-bits right? Is there key whitening? (I find it odd that few algorithms have strong or independently generated whitening keys, particularly given that one of the arguments for 128-bit DES is that it would only have 20% more gates)

1 0

Vault 7: Year Zero
by booty 08 Mar '17

08 Mar '17

hi ceecee ! -- List of japanese faces cia uses ¢‿¢ ©¿© o ª{•_•}ª ¬_¬ ¯＼(º_o)/¯ ¯\(º o)/¯ ¯\_(⊙︿⊙)_/¯ ¯\_(ツ)_/¯ °ω° °Д° °‿‿° °ﺑ° ´ ▽ ` )ﾉ ¿ⓧ_ⓧﮌ Ò,ó ó‿ó ô⌐ô ôヮô ŎםŎ ŏﺡó ʕ••ʔ ʕ•ᴥ•ʔ ʘ‿ʘ ˚•_•˚ ˚⌇˚ ˚▱˚ ''\\=(•●)=//' ° ʖ ° Σ ◕ ◡ ◕ Σ (ﾟДﾟ;） surprised Σ(ﾟДﾟ；≡；ﾟдﾟ) confusion Σ(ﾟДﾟ ) Σ(||ﾟДﾟ) scary Φ,Φ δﺡό σ_σ д_д ф_ф щ（ﾟДﾟщ） < "Dear god why‽ ) щ(ಠ益ಠщ) щ(ಥДಥщ) Ծ_Ծ ‿ _ ˚௰˚づ ˚ᆺ˚ว ᇂﮌᇂ) ๏๏ ๏๏) ◔◔ (××) (●•) (๏๏) (๏ ๏) (ಥ_ಥ) (••) (●•) (●●) (｡•‿•｡) (-•) (–) _ _ ↁﮌↁ ⌤_⌤ ॓_॔ १✌◡✌५ १|˚–˚|५ ਉ_ਉ ଘ_ଘ இ_இ ఠ_ఠ రృర ಠ¿ಠi ಠ‿ಠ ಠ⌣ಠ ಠ╭╮ಠ ಠ▃ಠ ಠ◡ಠ ಠ益ಠ ಠ益ಠ ಠ︵ಠ凸 ಠ , ಥ ಠ.ಠ ಠoಠ ಠ_ృ ಠ_ಠ ಠ_๏ ಠ~ಠ ಡ_ಡ ತಎತ ತ_ತ ಥдಥ ಥ‿ಥ ಥ⌣ಥ ಥ◡ಥ ಥ﹏ಥ ಥ_ಥ <So… Beautiful! ಭ_ಭ ರ_ರ ಸ , ໖ ಸ_ಸ ക_ക อ_อ อ_อ โ๏௰๏ใ ื ๏๏﴿ ๏๏ ๏๏﴿ ๏[-ิิ_•ิ]๏ ๏_๏ ໖_໖ ༺‿༻ ლ(´`ლ) ლ(◉◞౪◟◉‵ლ) ლ(ಠ益ಠლ) y u no guy ლ(╹◡╹ლ) ლ(◉◞౪◟◉‵ლ) ლ,ᔑ•ﺪ•ᔐ.ლ ᄽὁȍ őὀᄿ ᕕ( ᐛ )ᕗ ᕙ(⇀‸↼‶)ᕗ ᕦ(ò_óˇ)ᕤ ᶘ ᵒᴥᵒᶅ ← baby seal ‘︿’ •▱• •✞_✞• •ﺑ• •(⌚_⌚)• •_•) ‷ↂ凸ↂ‴ ‹•.•› ‹› ‹(•¿•)› ‹› ‹(ᵒᴥᵒ)› ‹(•¿•)› ↁ_ↁ ⇎_⇎ ∩(︶▽︶)∩ ∩( ・ω・)∩ happy dog ≖‿≖ ≧ヮ≦ ⊂•⊃_⊂•⊃ ⊂⌒~⊃｡Д｡)⊃ ⊂(◉‿◉)つ ⊂(ﾟДﾟ,,⊂⌒｀つ ⊙ω⊙ ⊙▂⊙ ⊙▃⊙ ⊙△⊙ ⊙︿⊙ ⊙﹏⊙ ⊙０⊙ ⊛ठ⊛ ⋋ō_ō` ━━━ヽ(ヽ(ﾟヽ(ﾟ∀ヽ(ﾟ∀ﾟヽ(ﾟ∀ﾟ)ﾉﾟ∀ﾟ)ﾉ∀ﾟ)ﾉﾟ)ﾉ)ﾉ━━━ ┌∩┐(◕_◕)┌∩┐ ┌( ಠ_ಠ)┘ ┌( ಥ_ಥ)┘ ╚(•⌂•)╝ ╭╮╭╮☜{•_•}☞╭╮╭╮ ╭✬⌢✬╮ ╮(─▽─)╭ ╯‵Д′)╯彡┻━┻ angry guy flipping a table ╰☆╮ □_□ ►_◄ ◃┆◉◡◉┆▷ ◉△◉ ◉︵◉ ◉_◉ ○_○ ●¿●\ ~ ●_● ◔◔ ◔ᴗ◔ ◔ ⌣ ◔ ◔_◔ ◕ω◕ ◕‿◕ ◕◡◕ ◕ ◡ ◕ ◖♪_♪|◗ ◖|◔◡◉|◗ <Huuuuur ◘_◘ ◙‿◙ ◜㍕◝ ◪_◪ ◮_◮ ☁ ☝ˆ~ˆ☂ ☆¸☆ ☉‿⊙ ☉_☉ ☐_☐ ☜❂Ⴢ❂☞ ☜(⌒▽⌒)☞ ☜(ﾟヮﾟ☜) ☜-(ΘLΘ)-☞ ☝☞✌ ☮▁▂▃▄☾ ♛ ◡ ♛ ☽▄▃▂▁☮ ☹_☹ ☻_☻ ☼.☼ ☾˙❀‿❀˙☽ ♀♀ヾ ♥‿♥ ♥╣[-_-]╠♥ ♥╭╮♥ ♥◡♥ ✌♫♪˙❤‿❤˙♫♪✌ ✌.ʕʘ‿ʘʔ.✌ ✌.|•˘‿•˘|.✌ ✖‿✖ ✖_✖ ❐‿❑ ⨀_⨀ ⨀_Ꙩ ⨂_⨂ 〆(・∀・＠) 《〠_〠》【•】_【•】〠_〠〴⋋_⋌〵の� �のニガー? ━━━━━━(ﾟ∀ﾟ)━━━━━━ ニガー? ペ㍕˚\ ヽ(´ｰ｀ )ﾉヽ(๏∀๏ )ﾉヽ(｀Д´)ﾉヽ(ｏ`皿′ｏ)ﾉヽ(`Д´)ﾉ ㅎ_ㅎ 乂◜◬◝乂凸ಠ益ಠ)凸句_句 Ꙩ⌵Ꙩ Ꙩ_Ꙩ ꙩ_ꙩ Ꙫ_Ꙫ ꙫ_ꙫ ꙮ_ꙮ 흫_흫 句_句 ﴾๏๏﴿ O'RLY? ¯\(ºдಠ)/¯ （·×·）（⌒Д⌒）（╹ェ╹）（♯・∀・）⊃ （　´∀｀）☆ （　´∀｀）（゜Д゜）（・∀・） "well" or "good" （・Ａ・） "bad" or "not good" （ﾟ∀ﾟ）（￣へ￣）（ ´☣///_ゝ///☣｀）（つ Д ｀）＿☆（ ´_⊃｀）☆＿｡◕‿‿◕｡｡◕ ‿ ◕｡ !⑈ˆ~ˆ!⑈ !(｀･ω･｡) (¬‿¬) (¬▂¬) (¬_¬) (°ℇ °) (°∀°) (´ω｀) (´◉◞౪◟◉) (´ヘ｀;) (´・ω・｀) (´ー｀) (ʘ‿ʘ) (ʘ_ʘ) (˚இ˚) (๏๏) (ΘεΘ;) (ι´Д｀)ﾉ (Ծ‸ Ծ) (॓_॔) (० ्०) (ு८ு_ .:) (ಠ‾ಠ) (ಠ‿ʘ) (ಠ‿ಠ) (ಠ⌣ಠ) (ಠ益ಠ ╬) (ಠ益ಠ) (ಠ_ృ) (ಠ_ಠ) (ಥ﹏ಥ) (ಥ_ಥ) (๏๏ ) (ღ˘⌣˘ღ) ♫･*:.｡. .｡.:*･ happy with music (ღ˘⌣˘ღ) - no thx (ᵔᴥᵔ) (•ω•) (•‿•) (•⊙ω⊙•) (• ε •) (∩▂∩) (∩︵∩) (∪ ◡ ∪) (≧ω≦) (≧◡≦) (≧ロ≦) (⊙ヮ⊙) (⊙_◎) (⋋▂⋌) (⌐■_■) (─‿‿─) (┛◉Д◉)┛┻━┻ (╥_╥) (╬ಠ益ಠ) (╬◣д◢) (╬ ಠ益ಠ) (╯°□°）╯︵ ┻━┻ table flip (╯ಊ╰) (╯◕_◕)╯ (╯︵╰,) (╯3╰) (╯_╰) (╹◡╹)凸 (▰˘◡˘▰) (●´ω｀●) (●´∀｀●) relieved happy (◑‿◐) (◑◡◑) (◕‿◕✿) cute happy (◕‿◕) (◕‿-) (◕︵◕) (◕ ^ ◕) (◕_◕) (◜௰◝) (◡‿◡✿) (◣_◢) (☞ﾟ∀ﾟ)☞ (☞ﾟヮﾟ)☞ (☞ﾟ ∀ﾟ )☞ (☼◡☼) (☼_☼) (✌ﾟ∀ﾟ)☞ (✖╭╮✖) (✪㉨✪) (✿◠‿◠) (✿ ♥‿♥) (　・∀・) (　･ัω･ั)？ (　ﾟ∀ﾟ)o彡゜えーりんえーりん!! (。・_・。) (つд｀) (づ｡◕‿‿◕｡)づ (ノಠ益ಠ)ノ彡┻━┻ table flip (ノ ◑‿◑)ノ (ノ_・。) (・∀・ ) (屮ﾟДﾟ)屮 "Come on" or "Come here" (︶ω︶) (︶︹︺) (ﺧ益ﺨ) (；一_一) (｀・ω・´)” innocent happy (｡◕‿‿◕｡) (｡◕‿◕｡) (｡◕ ‿ ◕｡) (｡♥‿♥｡) (｡･ω..･)っ (･ｪ-) (ﾉ◕ヮ◕)ﾉ*:･ﾟ✧ (ﾟДﾟ) "heh?" or "what are you saying?" or "surprised" (ﾟДﾟ)y─┛~~ smoking (ﾟ∀ﾟ) (ﾟヮﾟ) (￣□￣) (￣。￣) (￣ー￣) (￣(エ)￣) ( °° ) ( ´_ゝ｀) ( ° ʖ °) ( ~ ʖ °) ( ಠ◡ಠ ) ( •_•)>⌐■-■ ( 　ﾟ,_ゝﾟ) ( ･ิз･ิ) ( ﾟдﾟ)､ vomits saliva ( ^▽^)σ)~O~) ((((゜д゜;)))) (*´д｀*) (*..Д｀) (*..д｀*) (*~▽~) (-’๏_๏’-) (-＿- )ノ (/◔ ◡ ◔)/ (///_ಥ) (;´Д`) (=ω=;) (=゜ω゜) (>'o')> ♥ <('o'<) (n˘v˘•)¬ (o´ω｀o) (V)(°,,°)(V) (\/) (°,,°) (\/) WOOPwoopwowopwoopwoopwoop! (^▽^) (`･ω･´) ← Pedobear? (~￣▽￣)~ /╲/\╭ºoꍘoº╮/\╱\ <【☯】‿【☯】> = (ﾟдﾟ)ｳ @_@ d(*⌒▽⌒*)b o(≧∀≦)o o(≧o≦)o q(❂‿❂)p y=ｰ( ﾟдﾟ)･∵. shot my head \˚ㄥ˚\ \ᇂ_ᇂ\ \(ಠ ὡ ಠ )/ \(◕ ◡ ◕\) ^^ ^ㅂ^ _(๏๏)_ {´◕ ◡ ◕｀} {ಠ_ಠ}__,,|, {◕ ◡ ◕}

1 0

2017 - the best year yet for Israel
by Zenaan Harkness 08 Mar '17

08 Mar '17

First they legislate a travel ban: - https://www.rt.com/news/379709-israel-bars-boycott-supporters/ " A spokesperson for Smotrich earlier compared the bill to US President Donald Trump’s travel ban, saying “without going into the policies of the [US] president, every sovereign nation must set its policies in accordance with what is good for it,” The Times of Israel reported. " Next they're "warned" by Washington that annexing more land of their neighbours risks a "crisis" with America: - https://www.rt.com/news/379676-us-israel-west-bank-annexation/ “We received a message directly — not indirectly, not a hint — from the US, that Israeli sovereignty over the West Bank means an immediate crisis with the new administration,” Add in the Israeli protesters against their own country's ethnic cleansing program, a rapid global holohoax awareness, - http://www.renegadetribune.com/international-red-cross-report-confirms-holo… - https://www.radioislam.org/islam/english/revision/six_million_myth.htm - http://israelect.com/reference/WillieMartin/HOLOHOAX.htm - https://en.wikipedia.org/wiki/Holocaust_denial , similar rising awareness of who controls most of the world's fiat money supply: - http://www.rense.com/general85/feddrec.htm - The Jewish Story Behind the U.S. Federal Reserve Bank http://forward.com/culture/325447/the-man-behind-the-fed/ - https://europeanmediacentre.wordpress.com/2013/09/02/list-of-banks-owned-by… - http://www.realjewnews.com/?p=640 - https://archive.org/stream/HowHitlerDefiedTheInternationalBankers/HowHitler… and 2017 looks like a perfect storm for some ethnic awarenes to grip many of the world's people. Good luck fellow pepes :)

1 1

Rojava - Kurdistan - Assyrians - Neo-colonial use of "alien forefathers" conspiracies
by Zenaan Harkness 08 Mar '17

08 Mar '17

Interesting article for those so inclined: http://www.fort-russ.com/2017/03/ancient-aliens-neocolonialist-myth.html

1 0