- cypherpunks@lists.ogf.org

What you won't hear at Davos
by Ryan Carboni 27 Jan '16

27 Jan '16

The elites at Davos like to talk about change and improving lives, but some fly by helicopter from a private jet. They could have collectively chartered a plane to Zurich, and then take a train to Davos. It does become reminiscent in which Russia supports American democracy groups, and the US supports Russian democracy groups... democracy has become a buzzword for elites to reduce the autonomy of other elites. In 1793, it took less then a year for Napoleon to raise an army of a million men. In WWII, it took America several years to build up it's fighting strength to a level capable of fighting the Nazis. Perhaps today, if we were to start a military from scratch, it will take fifteen years to do it (probably longer if you desire aircraft). The point I'm making is indirect, there is a lot of inertia today brought on by the complexity of technology. The decisions made today once fully implemented cannot be changed for a while. The elites have made wrong decisions, they have erred in the direction of mass surveillance instead of mass liberty, but it did not stop the success of terrorists. Now we are all less secure. Apparently Juniper routers were backdoored... some of which were used by US agencies. One seems to hear more about the OPM hack then the Obamacare website being totally insecure. Government IT policies and organizations have been totally inadequate for a long time. The GCHQ wants MIKEY-SAKKE, as opposed to MIKEY-DH, they don't just want to intercept and decrypt future communications, they want to decrypt past communications ( as if that has been a major obstacle to investigations prior to the computer). But I ramble, to be very clear, to make the internet itself secure, it will probably take ten years. While frequent derisions that people don't use encrypted databases are nonsensical, the solutions more likely to yield a result will take longer to implement. Basically ten years ago, all the elites made the wrong choice, and they don't even have the excuse of saying they properly weighed the issues.

4 4

Darknets: Full of onions, and eeps, and other wondrous things
by grarpamp 27 Jan '16

27 Jan '16

> Email to tor-talk@ [0] made me wonder if (some of) these > are run by the same people that have been trying to hijack > Bitcoin transactions. In the first step, they could enumerate > services by crawling them That would be useful to get an early start in the spamming / seeding publication below. > and setting up an impersonation > site that has substituted Bitcoin addresses on it. There's no need to 'mirror' or 'clone' or 'set up a site', the good ones are just transparent cleartext proxies, one onion in front of another. They can be timed, but don't fall to the dynamic content and update differences that mirrors do. Regardless, the last step is publication of the proxy. This is done in wholesale on onionland services such as forums and the now tens of wannabe 'hidden wikis', many of which are run by the same actors, obviously adding to the attack surface. Users surf them, they and the links looks legit, they get bookmarked and that's that till they somehow find out. It's been going on that way for years. All onionland services should be considered suspect, even email, syndication and storage. > Finally, they are > running malicious exists that rewrite onion domains to their own > impersonation sites. Exit rewriting is an easy way to skim another fraction of users without needing to play with forums and wikis. As interesting as why, is that there are so many. Those willing to immerse themselves in the corners of onionland would probably find some insight, at least for that which comes from there. Topside ventures that reach down into onions would be different story. Databasing, crime, anti-crime, covert stuff, games, research, hacking, and even the overriding majority of everyday legitimate use by users around the globe.... The story and scaling over time of all these aspects is becoming quite interesting. > [0] <https://lists.torproject.org/pipermail/tor-talk/2016-January/040038.html>

1 0

Network Analysis of Overlay Networks, Capabilities, Fill Traffic [was: VPN less safe?]
by grarpamp 26 Jan '16

26 Jan '16

On Tue, Jan 26, 2016 at 3:09 PM, juan <juan.g71(a)gmail.com> wrote: > On Mon, 25 Jan 2016 10:25:20 -0500 > Paul Syverson <paul.syverson(a)nrl.navy.mil> wrote: > > >> "20,000 In League Under the Sea: Anonymous Communication, Trust, >> MLATs, and Undersea Cables" available at >> http://www.degruyter.com/view/j/popets.2015.1.issue-1/popets-2015-0002/pope… > > > As far as I can see, most if not all of the paper deals with a > way to organize information about 'network topology' but > there's no concrete data regarding which > systems/relays/cables/people/IXPs/ASs/whatever are > 'compromised'. > > ...though the section on cables and cooperation between so > called nation states seems to suggest that virtually all the > world's infrastructure is 'compromised'? The USA and Soviets have decades experience tapping cables around the globe in a cold war sense. The USA/FVEY has top secret blackops and administrative via corp partnership and various legal and extralegal access to extensive cable, hardware, and organizational assets around the globe. It is simply foolish to not assume that the world is highly compromised by these actors. Snowden and all the other surveillance and bigdata news and political rhetoric have been telling you that for over a decade now. You might be safe if you are in a locale untouchable by these actors, conduct all your activities in that locale, and have no similar local adversaries. > Also, is there a more concrete analysis of what can be > achieved by monitoring traffic on those cables? Did you just push a bunch of packets over time into your ISP and have google send replies back? Well, they can see both ends, so they saw that traffic pattern in and out, and back in and out, so they know who's talking to who and when. > Specifically, > how easy it is for your government to find users and especially > servers in the tor network or similar networks (i2p, freenet > etc) In addition to simple taps, they can also deploy passive or active nodes in any of these networks at will. And use all the tools to perturb things in favor of their efforts. Tor and other networks are good at hiding endpoints (users, servers) from each other, keeping traffic content encrypted over the wire, letting you anonymously publish and consume stuff among other users that isn't really of interest to (against) such adversaries (and thus won't get you killed or jailed or disappeared (but will still get you databased for life)), and getting around some censorship. That's probably about it. However when it comes to such global (and regionally lucky) passive adversaries, and adversaries operating the networks themselves, I seriously doubt anyone can say with a straight face that these networks protect against network analysis... who is talking to who and when. It would be harder for that analysis to succeed against networks that filled between all the nodes with fill traffic when unused and not needed for user traffic. (And in the sense of Tor, between clients and some number of guards). But that's hard to design so that it is functional. And no one in the overlay network / messaging field really seems to be trying it. Mindset, OMG bandwidth, probably buzzkills most research before it gets started. Here's some recent mostly tor specific threads if anyone's interested, plus whatever else has come up whenever I've mentioned this. https://lists.torproject.org/pipermail/tor-dev/2016-January/010257.html https://lists.torproject.org/pipermail/tor-dev/2016-January/010290.html > There's also mention of 'user beliefs' and 'trust'. That > strikes me as weird. You seem to be saying that routes > can be choosen according to users' beliefs, not according to > real world facts? It doesn't matter if system X is hostile, > what matters is what the user believes about system X? Users often have better knowledge of the laws, operations and general feel in their countries and locales and areas of expertise than a handful of distant project maintainers largely based in one geopolitical exposure might have. You can download science, but you need more than that to win a street fight.

1 0

Fwd: Welcome to the Smoogs Demo
by Robert Hettinga 26 Jan '16

26 Jan '16

> Begin forwarded message: > > From: smoogs.io <hello(a)smoogs.io> > Subject: Welcome to the Smoogs Demo > Date: January 26, 2016 at 4:21:59 PM AST > To: R. <hettinga(a)gmail.com> > Reply-To: smoogs.io <hello(a)smoogs.io> > > January 2016 smoogs.io <http://smoogs.io/> | Our Demo is live! > View this email in your browser <http://us11.campaign-archive2.com/?u=4976c2cf744a22a25735e6758&id=73b4f72ca…> > > Little bits of data for little bits of money > Our Demo is Live! > This demo shows how we can charge users for every 10 seconds of video streamed, but the application possibilities are endless! We are changing the way you consume content online: stream for live concerts, read one chapter of a textbook, learn a language, and pay as you go. > > *We use testnet bitcoins (fake money) for the demo* > LET'S SMOOGIE! > <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> > Need help with Testnet Bitcoins? > 1. Get a Testnetwallet <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…>for a quick trial or Copay <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> for regular use. > > 2. To get test coins try Bitcointestnetfaucet <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> or email us at demo(a)smoogs.io <mailto:demo@smoogs.io> with your wallet's "Receive" address and we'll send some over. > > 3. Once you've got your wallet and coins, you can check out the demo! > *A Note From The Founders* > > Smoogs.io <http://smoogs.io/> is all about micropayments for metered services. Both of us come from developing countries, where people crave services from the developed world; in parallel, the economies of our countries are unstable, making it hard to budget for subscription contracts. We saw the need for a PAYG system which makes it easy to bring first world services to the rest of the world, at a price below the financial pain threshold of the masses - We enable people to pay for the little bits most important to them. > > The beta product (phase 2) will have: > Real bitcoin payments > Client Dashboard for pricing and stream adjustments > Usage Analytics > Widget options for customers > Live Support > We want to hear from you! Tell us what you think about our demo and we'll use your feedback to better our beta. > > Thanks, > — Neha and Daryl > <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…> Share <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> > <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…> Tweet <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…> > <http://us11.forward-to-friend.com/forward?u=4976c2cf744a22a25735e6758&id=73…> Forward <http://us11.forward-to-friend.com/forward?u=4976c2cf744a22a25735e6758&id=73…> > <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> Share <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…> > Copyright © 2016 Smoogs Limited, All rights reserved. > You are receiving this because we like you! > > Want to change how you receive these emails? > You can update your preferences <http://smoogs.us11.list-manage1.com/profile?u=4976c2cf744a22a25735e6758&id=…> or unsubscribe from this list <http://smoogs.us11.list-manage.com/unsubscribe?u=4976c2cf744a22a25735e6758&…> > > <http://www.mailchimp.com/monkey-rewards/?utm_source=freemium_newsletter&utm…> > <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…> Follow <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> > <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…> Website <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> > <http://smoogs.us11.list-manage.com/track/click?u=4976c2cf744a22a25735e6758&…> LinkedIn <http://smoogs.us11.list-manage1.com/track/click?u=4976c2cf744a22a25735e6758…>

1 0

Litvinenko docs pre-September 25 redaction and removal
by Michael Best 26 Jan '16

26 Jan '16

After September 25th, a number of documents from the Litvinenko inquiry were redacted or removed from the official sites. Any chance anyone grabbed any of them? I'm grabbing the ones from the Wayback Machine, but a lot of those files are missing so I'm not sure how many of the redacted/removed documents were saved this way.

2 1

America: *owned*
by grarpamp 26 Jan '16

26 Jan '16

https://theintercept.com/2014/12/17/billion-dollar-surveillance-blimp-launc… http://tinypic.com/r/r7j7rl/9

3 2

FOIA: National Reconnaissance Office NROL-39 Octopus Mission Patch
by Rayzer 25 Jan '16

25 Jan '16

"A giant squid sucking the face off of North America" ~Jon Stewart The logo was widely lampooned as emblematic of the intelligence community's tone-deafness to public sentiment. Incidentally, an octopus enveloping the planet also so happens to be the logo of SPECTRE, the international criminal syndicate that James Bond is always thwarting. So there's that. Privacy and security researcher Runa Sandvik wanted to know who approved this and why, so she filed a FOIA with the NRO for the development materials that went into the logo. A few months later, the NRO delivered. https://www.muckrock.com/news/archives/2016/jan/19/octopus-NRO/ -- RR "Freedom is the capacity to pause between stimulus and response." ~Rollo May

3 7

PROMIS/Inslaw Affair docs
by Michael Best 24 Jan '16

24 Jan '16

I've uploaded a few dozen documents on PROMIS to That1Archive.neocities.org <http://that1archive.neocities.org/>, including reports, memos, research papers, briefing papers and an affidavit. Background: https://en.wikipedia.org/wiki/Inslaw --Mike That1Archive.neocities.org

1 0

Drivers Licenses? We Don' Need No Steekin' Licenses
by Rayzer 23 Jan '16

23 Jan '16

*The Decline of the Driver's License* /Fewer people of all ages are getting them, and it’s not quite clear why./ Julie Beck Jan 22, 2016, The Atlantic Remember how, in /Clueless, /Alicia Silverstone’s character Cher fails her driver’s test after nearly killing a biker and scraping her car alongside several parked cars? And then how she asks, “Do you think I should write them a note?” as she drives away? And then how, at the climax of the movie, her friend Tai (Brittany Murphy) calls her “a virgin who can’t drive <https://www.youtube.com/watch?v=TY0bHULptWQ>” and it is just the harshest burn? Well, that was a fictionalized version of the ‘90s, and this is now. Things are different. Young people are not getting driver’s licenses so much anymore. In fact, no one is. According to a new study <http://www.umich.edu/%7Eumtriswt/PDF/UMTRI-2016-4_Abstract_English.pdf> by Michael Sivak and Brandon Schoettle at the University of Michigan Transportation Research Institute, the percentage of people with a driver’s license decreased between 2011 and 2014, across all age groups. For people aged 16 to 44, that percentage has been decreasing steadily since 1983. It’s especially pronounced for the teens—in 2014, just 24.5 percent of 16-year-olds had a license, a 47-percent decrease from 1983, when 46.2 percent did. And at the tail end of the teen years, 69 percent of 19-year-olds had licenses in 2014, compared to 87.3 percent in 1983, a 21-percent decrease. Among young adults, the declines are smaller but still significant—16.4 percent fewer 20-to-24-year-olds had licenses in 2014 than in 1983, 11 percent fewer 25-to-29-year-olds, 10.3 percent fewer 30-to-34-year-olds, and 7.4 percent fewer 35-to-39-year-olds. For people between 40 and 54, the declines were small, less than 5 percent. Above 55, the story’s a little different. Older adults were more likely to have a driver’s license in 2014 than in 1983—in the case of those 70 and older, 43.6 percent more likely. But these age groups, too, saw a modest decline from 2011 to 2014. The researchers didn’t look into what the reasons for this decline might be, but in an earlier study, they surveyed <http://www.umich.edu/%7Eumtriswt/PDF/UMTRI-2013-22_Abstract_English.pdf>young adults ages 18 to 39 without driver’s licenses about why they don’t have them. The top three reasons were: “too busy or not enough time to get a driver’s license” (37 percent), “owning and maintaining a vehicle is too expensive”(32 percent), and “able to get transportation from others” (31 percent). Another reason that springs to mind is that more people are living in cities and using public transportation. But in the survey, only 17 percent said their reason for not having a license was that they preferred public transit. In other studies, Sivak and Schoettle suggest that driving in general may have already peaked in the United States. The total distance driven per person in the U.S. was at its highest in 2004, and by 2013, it had decreased by 9 percent. In part, this may be because people are traveling less in general: Comparing 2004 to 2014, people spent less time traveling to places to eat and drink, to buy goods and services, to work, school, and to leisure activities. The ease of Amazon, the rise of teleworking, and the endless entertainment provided by the Internet may be leading people to stay home more, but it’s hard to say—there’s no research available that explains these trends. A /New York Times article <http://www.nytimes.com/2013/05/14/us/report-finds-americans-are-driving-les…>/ from 2013 mentions unemployment as a reason for young people buying fewer cars, but as Jordan Weissman noted in /The Atlantic/ <http://www.theatlantic.com/business/archive/2013/11/crash-the-decline-of-us…> that same year, downward trends in driving started before the recession. Maybe it’s just that people today have more things they’d rather do than practice parallel parking between traffic cones. Or maybe it’s because the photos on those plastic cards are almost never flattering. Sivak and Schoettle are hoping to soon study possible reasons for the drop in driver’s licenses. But regardless of the cause, it seems that if you want to insult a teen today, shaming them for not being able to operate a motor vehicle might not be the way to go. http://www.theatlantic.com/technology/archive/2016/01/the-decline-of-the-dr… -- RR "Freedom is the capacity to pause between stimulus and response." ~Rollo May

1 0

Fwd: [liberationtech] MS&E 297: Hacking for Defense (New Course Spring 2016)
by Travis Biehn 23 Jan '16

23 Jan '16

http://hacking4defense.stanford.edu/dodic-problems.html "National Security Agency (NSA) To be provided" This incubator for contracted solutions to whatever has provided an world rw google doc for helping Stanford students organize into participatory groups. https://docs.google.com/spreadsheets/d/1oXvCSrFzr2PoIDvOmQPaloJN_JxXFpwXNFl… *Don't do anything disruptive here. +1 to the Palantir employees who are already in it to win it. Perhaps the rest of the project will be conducted on world r/w google drive? -Travis ---------- Forwarded message ---------- From: Yosem Companys <companys(a)stanford.edu> Date: Mon, Jan 18, 2016 at 8:55 PM Subject: [liberationtech] MS&E 297: Hacking for Defense (New Course Spring 2016) To: Liberation Technologies <liberationtech(a)lists.stanford.edu> Cc: Kimberly Diane Chang <kdchang(a)stanford.edu> From: Kimberly Diane Chang <kdchang(a)stanford.edu> *MS&E 297 - Hacking for Defense * Solving National Security Issues with the Lean Launchpad Interested in Entrepreneurship? Innovating at speed? Helping to make the world a better place? Working closely with members of the military and government to solve real, important problems? Then consider applying for MS&E 297 - Hacking for Defense. A new class in Spring 2016 with a teaching team led by *Steve Blank *and including *Tom Byers *(Professor MS&E), *Joe Felter* (CISAC Senior Research Scholar), and *Pete Newell* (Managing Partner BMNT Partners). In the class, students will apply the Lean Launchpad methodology to problems proposed or approved by Department of Defense/Intelligence Community sponsors. Some of the problems already approved include: Humanitarian Assistance / Disaster Relief Mobile and Web based App (National Defense University) Distributed, Disposable, Intelligence, Surveillance, and Reconnaissance (Commander US Navy 7th Fleet) Virtual Advice and Assistance Toolkit for IEDs (Joint Improvised Threat Defense Agency) Wearable Sensors and Apps for Divers (Naval Special Warfare Group 3) Interested in solving a problem not listed here but potentially related to the government or military? Contact the teaching team. To learn more, visit our website: hacking4defense.stanford.edu To receive updates about upcoming info sessions and brown bag lunches. Join our Facebook group <https://www.facebook.com/groups/1556101194680136/> or sign up on our email list <https://docs.google.com/forms/d/1ZHM-ahQGIIYRCxyS2aP0XgIHwG-NF7oDJuF3LiESQx…>. -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu. -- Twitter <https://twitter.com/tbiehn> | LinkedIn <http://www.linkedin.com/in/travisbiehn> | GitHub <http://github.com/tbiehn> | TravisBiehn.com <http://www.travisbiehn.com> | Google Plus <https://plus.google.com/+TravisBiehn>

6 11