- cypherpunks@lists.ogf.org

New functionality of Facebook
by Tomas Overdrive Petru 12 Nov '15

12 Nov '15

I know nobody will like this, because mood is fck Facebook here, but I like this small step as example: Just by accident I have found Facebook have text field in settings where you can insert your public key and after confirmation email communication between your inbox and Facebook will be encrypted. Update your info -> contact and Basic Info -> PGP Public Key Regards, - Over -- “Borders I have never seen one. But I have heard they exist in the minds of some people.” ― Thor Heyerdahl Telegram...................@over23 facebook...................facebook.com/overdrive23 projects...................https://brmlab.cz/user/overdrive twitter....................https://twitter.com/#!/over2393 last.fm....................http://www.last.fm/user/overdrive23 GnuPG key FingerPrint......08EA E4DC EF85 0F02 9267 5B48 2E58 6902 C5F8 794C Public key ................http://overdrive.dronezone.eu/overdrive.txt

3 2

Australia's human rights application to the United Nations Human Rights Council
by Zenaan Harkness 12 Nov '15

12 Nov '15

Australia wants an illustrious seat on this body self tasked with being "responsible for the promotion and protection of all human rights around the globe": http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11543178 http://www.ohchr.org/en/hrbodies/hrc/pages/hrcindex.aspx With Saudi Arabia heading up part of the United Nations Human Rights Council: https://en.wikipedia.org/wiki/United_Nations_Human_Rights_Council#Saudi_Ara… , Australia should fit right in. Bloody ratbags, whitewashing (but only sanctioned) genocide around the planet. No wonder Australia wants to join. Zenaan

1 0

Ethical Tor
by Ryan Carboni 12 Nov '15

12 Nov '15

https://blog.torproject.org/blog/ethical-tor-research-guidelines Interesting problem: to use Tor is to say you trust your ISP less than some pseudorandom person over the internet.

3 2

Re: [Cryptography] Cryptogit
by grarpamp 11 Nov '15

11 Nov '15

On Wed, Nov 11, 2015 at 4:27 AM, Markus Wanner <markus(a)bluegap.ch> wrote: > On 11/10/2015 08:45 AM, grarpamp wrote: >> PKI built in, that may serve as a idea / base for further encryption work... > does not support encryption of data. I meant further crypto work to include encryption.

1 0

UK To Demand Backdooring Else Prison [Crypto In Devices, Email And More]
by grarpamp 11 Nov '15

11 Nov '15

http://arstechnica.co.uk/tech-policy/2015/11/snoopers-charter-uk-govt-can-d… Buried in the 300 pages of the draft Investigatory Powers Bill (aka the Snooper's Charter), published on Wednesday, is something called a "technical capability notice" (Section 189). Despite its neutral-sounding name, this gives the UK's home secretary almost unlimited power to impose "an obligation on any relevant operators"—any obligation—subject to the requirement that "the Secretary of State considers it is reasonable to do so." There is also the proviso that "it is (and remains) practicable for those relevant operators to comply with those requirements," which probably rules out breaking end-to-end encryption, but would still allow the home secretary to demand that companies add backdoors to their software and equipment. That's bad enough, but George Danezis, an associate professor in security and privacy engineering at University College London, points out that the Snooper's Charter is actually much, much worse.

2 2

PGP, Mail, Devices, P2P, Bans, Utility [was: UK Crypto]
by grarpamp 11 Nov '15

11 Nov '15

> Its easier to make a slick UI than convince people to do work. Is it > so much to ask that people who make software try to make life easy for > their users? Apple understands and successfully applies that. They put their UX and code camps together. It's something open source coders should solicit more into their fold... open source UX'ers. Assuming for example that Apple's phone crypto really is as good as their word, then the only real weakness is whatever cheesy screenpass it takes to login, yet so long as you *can* enter a strong 128 bit, insert a cryptokey, whatever... then it services everyone well enough. > You can drive a car mostly successfully without too much information but > if it stops at the side of the road and the limited info from your dials > doesn't tell you what's wrong then a bit more knowledge might just get > you home. > If anything, this matches the Enigmail model more than the invisible > crypto model. Sure, level based access to more details and knobs is fine. Dummy Mode, Medium Mucking, and Advanced Footshooting > - Your key gets signed by your friends, so now your friend network public > - Emails with PGP are provably from you, in a way that can be traced > back to physically witnessed government ID. Then don't have your key signed, and or be a nym and sign those of nyms you trust based on context, not on govts. Use of WOT is an option there if you want it, not every use case of PGP needs it. > PGP as a *product* it was a complete failure. I mean, it > doesn't even protect metadata. No, PGP is excellent, at what it does. Like any other tool, it fails when people foolishly try to make it do what it can't in situations it shouldn't. There is no blame on the tool there, only upon the people stubbornly bashing their head trying to make it fit. Continuing to talk about traditional SMTP transport services as fixable by bolting on whatever... is futile, ignorant, and old. All the people circlejerking on Metzdowd about designing crypto fixes into existing SMTP models, and all the newfangled encrypted webmail providers fall into that category. > the metadata issue a big problem for everyone who connects to a > server that isn't owned by them and I suspect really requires a new mail > protocol to resolve. Owning both ends hides the non-body elements, but you're not hiding dns lookups, sizes, the fact that you hit send, etc. It's not a new mail protocol that's needed, it's a whole new messaging network. > the only option is to make GPG transparent by getting the > email providers to automatically create key pairs and automatically > handle signing and encryption by integrating their mail services with > GPG behind the scenes. No, this is a non option. - Free providers are out for their own, like govts, they have no real interest in their users going dark. - Paid providers are a bit more loyal, but building that and making statements about it entails risk of suit for failure such that they're not really inclined. Most of them can't even put postfix, dovecot and openldap together reliably and scalably, let alone functional spam control and peering. - You're still trusting your keys to the provider, and that the provider won't be forced to jack you through your browser or whatever cool software they give you. In today's world, that is an abject failure. As before: Traditional centralized messaging services are a failure. There is NOTHING you can do to fix them but to replace them. That is where you have the chance to integrate crypto and defenses. And the only valid thing to replace them with now against the risk of centralization and all but godlike attack is a new anonymous encrypted P2P messaging transport system that scales [1]. You could create a new UI on all the platforms, and for faster adoption encapsulate existing message format within and extend existing clients to deal with the cryptographic addressbooking and keep it Unix and business needs pipeliney. You could include storage and nym registration. But at minimum you need to shuffle messages between cryptographic endpoints within the net. Anyways, you're wasting your time talking about PGPifying webmail, desnooping and delogging SMTP, and poor little Johnny. Forget about that tired old refit shit and build something new. Put a little bling and sound effects in it, call it an IM, it worked for ICQ and Candy Crush. The users will come, trust me. Do it soon so you can try to head off bans with your newfound embedded ubiquity. [1] We have a handful of researched and implemented systems now. But don't yet have enough knowledge, experience and wisdom to determine what really should go into one that will remain valid for the next 30 years of relatively stable internet API as we know it [2]. There's a good rate of people deploying new p2p, crypto, anti-metadata, attack resistant, network tech such that by 2020 we may have explored enough areas to begin to feel confident in assembling a handful of them into such a system... even into a number of systems... messaging, storage, info / data distribution, payments. But it will take all of us trying them out and contributing to do it. [2] Packet switched IPv6 routed global end to end connectivity. https://en.wikipedia.org/wiki/Internet https://en.wikipedia.org/wiki/History_of_the_Internet

1 0

Re: FOIA MuckRock API
by coderman 11 Nov '15

11 Nov '15

On 11/10/15, Michael Morisy <m(a)morisy.com> wrote: > I don't, for me it crashed around page 40 when I had it doing 20 > requests a page, but good chance I was doing something dumb/it was a > problem with my computer comparing Python versions might be useful. (i am using 2.7.6 for this test) > Mitch wrote some export code that's much cleaner in case it's helpful, > with the big caveat that it drops everything into JSON files instead > of txt and PDF. thanks; i'm past 90 pages now, and wondering if this is a particular edge case with some specific versions of Python, urllib, requests - the whole crew are a motley bunch! last question: API only credentials, like a "Device Login" or API token, which don't use primary username and password: are these on the roadmap? i don't mind this method much, since i generate unique user and passwords anyway, but it is good practice to have separate credentials for the bots and scripts :) thanks again!

1 0

FOIA MuckRock API
by Michael Best 11 Nov '15

11 Nov '15

I've been in on-and-off contact with Michael Morisy over at MuckRock, and one of the things that's come up is the API script that they're working on the export the FOIA requests and responses. Unfortunately, the script crashes after processing a few dozen, but not consistently - likely the result of character encoding issues. He's given me permission to share the in-progress script. https://github.com/MuckRock/API-examples/blob/master/export_all_requests_as… If anyone is able to look at the code and offer any ideas about solutions (or even pinpointing the problem), it'd be a great public service. I'm not code savvy enough to help, but I'm hoping someone on the list can bring in some fresh eyes and help MuckRock get the script working. --Mike

2 2

UK's GCHQ and NCA: Joining Forces To Ferret Out Darknet
by grarpamp 11 Nov '15

11 Nov '15

http://motherboard.vice.com/read/the-uk-will-police-the-dark-web-with-a-new… The Joint Operations Cell will increase our ability to identify and stop serious criminals. The creation of this unit should finally shatter the image that GCHQ solely focuses on national security matters or terrorism cases. At the summit, it was said that GCHQ's technical skills would be its contribution to the unit. The JOC is a genuinely innovative development, using the best of our respective agencies' skills.

1 0

DropZone: An Anonymous Peer-To-Peer Local Contraband Marketplace
by grarpamp 10 Nov '15

10 Nov '15

https://github.com/17Q4MX2hmktmpuUKHFuoRmS5MfB5XPbhod To whom it may concern, Markets are objects of censorship and always have been. There is a presumed division, that renders commerce distinct from the notion of free speech. But I will allege that the act of commerce is, itself, indistinct from speech. Where or how one spends their value is a decision as personal and poignant as any words ever spoken or letters ever written. As a unfortunate consequence of freedom, bad actors will engage in repugnant trade that impinges upon the rights and freedoms of others. It is the job of humanity to cooperate and see to it that trade, such as this, becomes unprofitable. Whether it is accomplished through technological achievement or through the adjustment of social mores, or perhaps a simple appeal to the underlying natural law, it is not the job of bad acting third parties to force into hiding commerce that must be dealt with by means of an adjustment to the global, social conscience. Cooperation, in the manner I was just speaking about, has never been plausible until the invention of The Blockchain. I will not foist upon Satoshi's humble creation such impracticable possibilities as the achievement of world peace. But in approaching Drop Zone, I am attempting to do nothing more than what is possible and possibly more efficient than what exists. I wish for Drop Zone to be nothing more than an appendage to The Blockchain. As such, it is every bit as much Bitcoin as Bitcoin itself. Just as a fungible Bitcoin enables the exchange of spaceless value with near impunity, Drop Zone removes the ability of unwelcome parties from glancing over the shoulders of those in the act of an exchange, whatever it entails. This technology disrupts the ability of buyers to gain insight into the identities or movements of suppliers making supply chains far less vulnerable to disruption. It is this innovation that separates this project from all other decentralized market solutions. Whereas Bitcoin forces us to consider the nature of money and value, Drop Zone will do the same for commerce. At its root, Bitcoin is a message passing system. Those messages that are passed, unlike any electronic message that's come before it, articulate value. Commerce is, and has always been, similarly inclined toward message passing. Whether in-person, over email, or through large, online shopping carts, fundamentally, commerce is composed of messages that are in service of the transaction wherein a final message of value is sent to a recipient in exchange for a negotiated good or service. As such, Drop Zone is a secure message passing protocol inasmuch as it is a platform for commerce. And while the problem is far beyond the scope or capabilities of the protocol in its most fundamental form, the observant might even see the tenuous skeleton of a full-fledged reputation system. Such a project is, in itself, as important and difficult as any facing this decentralized ecosystem. I hope that Drop Zone lets us all dream of a day when no man will any longer be made to suffer indignity for simply engaging in unpopular or stigmatized commerce. May all commerce be created equal. Today is a Beautiful day, Miracle Max quia omnis qui se exaltat humiliabitur et qui se humiliat exaltabitur

1 1