- cypherpunks@lists.ogf.org

Fwd: Re: [bestbits] Indian Encryption Policy
by rysiek 25 Sep '15

25 Sep '15

Well, that's going to be fun. ---------- Treść przekazywanej wiadomości ---------- Temat: Re: [bestbits] Indian Encryption Policy Data: poniedziałek, 21 września 2015, 15:42:05 Od: Mishi Choudhary Hi Carol, Thanks for highlighting this. Its a draft National Encryption Policy and public comments are invited by October 16, 2015. Comments are to be emailed to Mr A,S.A. Krishnan, akrishnan(a)deity.gov.in The key highlights of the policy are : 1. A stipulation that businesses and citizens are to maintain plain text (unencrypted) copies of encrypted content for a period of 90 days, to be made available to Law Enforcement Agencies (LEAs) when so directed under law. 2. Vendors of encryption products are required to register their products with the Government as a pre-condition to conducting business in India. They are also expected to re-register their products with every update. This requirement is not limited to vendors of dedicated encryption products, and seemingly includes even products that use encryption in the course of providing a larger service such as messaging or e-commerce. (Service Providers located within and outside India, using Encryption technology for providing any type of services in India must enter into an agreement with the Government for providing such services in India). 3. Encryption algorithms and key sizes shall be prescribed by the Government through Notifications from time to time. ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

2 1

State of the art in directing human made ball lightning?
by Georgi Guninski 25 Sep '15

25 Sep '15

Probably offtopic, but would like to know what is the state of art in directing human made ball lightning (or something close to it). According to wikipedia: https://en.wikipedia.org/wiki/Ball_lightning#Laboratory_experiments humans made stuff close to it (was surprised one way involves home microwave oven). By "directing" I mean controlling its way.

1 0

William F. Friedman documents now on Internet Archive
by Michael Best 24 Sep '15

24 Sep '15

I uploaded the 7,000+ Friedman NSA docs to the Internet Archive and used the metadata to rename the titles into something a little easier for humans to read and sort. https://archive.org/details/nsa-friedman The complete set of Friedman docs are also included in the NSA FOIA vault at https://archive.org/details/NSA-FOIA-Vault ( https://archive.org/compress/NSA-FOIA-Vault to get the entire vault in a single zip). To grab just the Friedman docs and not the rest of the NSA FOIA vault, go to https://archive.org/download/NSA-FOIA-Vault/Friedman%20Documents.7z -- I should point out that the collected version includes the metadata file, but file names are unchanged and unassociated with human readable titles. These are the same copies released through the NSA's website, just a bit easier to sort and read. Enjoy.

1 0

Fwd: [bestbits] Update: Indian Encryption Policy
by rysiek 24 Sep '15

24 Sep '15

Aaand it's gone. For now. ---------- Treść przekazywanej wiadomości ---------- Temat: [bestbits] Update: Indian Encryption Policy Data: wtorek, 22 września 2015, 11:03:21 Od: Mishi Choudhary Post a public outcry, DEITY has withdrawn this policy. ----------------------------------------- -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147

1 0

FCC NPRM seeks to end open SDR
by wirelesswarrior＠Safe-mail.net 24 Sep '15

24 Sep '15

Since the early days of open SDR these devices have been sold as test equipment which does not require onerous type approvals or certifications by the manufacturer or importer. The FCC now seeks to change this https://www.federalregister.gov/articles/2015/08/06/2015-18402/equipment-au… and require product features which block software changes after manufacture. This, of course, is the very heart of SDR and its prohibition would be nothing short of effectively banning SDR and any open source experimentation with RF signal processing beyond the theoretic. WW

3 2

Activists leak Russian government’s plans to create a ‘national Internet’
by Anton Nesterov 24 Sep '15

24 Sep '15

The data-leaking blog Anonymous International, also known as Shaltai-Boltai (Humpty Dumpty), has published the Russian government’s project proposal for creating a "national information platform," which would serve as an alternative Russian Internet. According to Anonymous International, the project was drawn up by Russia’s Foreign Trade Bank cluster analysis and spatial development director Sergey Ganzya, the IT director of the hydroelectricity company RusHydro, Garald Bandurin, and several other people. The leaked content includes email correspondence and a document about the project. In the leaked emails, the authors of the project discuss the creation of “an entirely custom IT platform that can expand globally.” The development of such a platform can serve as “import substitution in the IT sphere” and “create a secure national digital environment with lower risks than in the global www-field.” The document published by Anonymous International mentions Russia’s direct dependence on “the goodwill and decency of global providers of IT solutions.” The authors of the document believe that “there are no objective guarantees that, in the event of a conflict, Western security agencies won’t paralyze—or, worse, seize—direct control over elements of the infrastructure.” The leaked emails between the project’s authors refer to the “general officers” of Russia’s “Oplot Rossii” party, which was tasked with delivering the project proposal to Russian President Vladimir Putin. The correspondence dates to June 2015. https://meduza.io/en/news/2015/09/23/activists-leak-russian-government-s-pl… -- https://nesterov.pw GPG key: 0CE8 65F1 9043 2B11 25A5 74A7 1187 6869 67AA 56E4 https://keybase.io/komachi/key.asc

3 3

Re: How Putin Controls the Internet and Popular Opinion in Russia
by John Young 23 Sep '15

23 Sep '15

This from the journalists who check with USG before publishing Snowden documents as Snowden allegedly requires "to avoid harm to the US." Fingerpointing at Putin is obligatory for those working the Broadcasting Board of Governors propaganda beat. The Internet as an unprecedented global spying and propaganda machine has been long noted and carefully exploited by all varieties of spies and media -- used by all governments, but by US first and foremost. For a few years the Information Highway was perceived as a marvelous invention for public education and discourse, even a whiz-bang tool for shaping politics and government, empowering the citizenry. Was long before it was understood to be a gov-com-edu-org hegemon siphoning user data indiscriminately, some openly, some secretly. Encryption has been advocated to maintain citizen privacy and security. That too has been exposed as illusory, but die-hard security promoters will not sacrifice reputation and profits for perpetuating the notion that reliable infosec and comsec are "the best we can do, don't expect absolute security." Meanwhile continuting to rig standards and products to fit USG contracting requirements. Keeping up with these requirements is a top requirement for benefiting from official secrets. Still unrevealed by Snowden is what he did as CIA IT employee for many years before a few months deep undercover NOC as an NSA contractor. At 12:25 AM 9/9/2015, you wrote: >https://theintercept.com/2015/09/08/how-putin-controls-the-russian-internet/ >The key paragraph in Andrei Soldatov and Irina Boroganâs new book, The >Red Web, comes surprisingly late, after the authors have described the >long and ambitious construction of a wide-ranging, all-penetrating >Internet surveillance and censorship system in Russia. >... >Just as the Soviet system discovered that it did not need to exert >total pressure in order to control its population, so the Kremlin has >now demonstrated that it does not need to block every byte in order to >exert utter dominance over information.

11 42

Windows 10
by Endless 23 Sep '15

23 Sep '15

Hello Cypherpunks! As many of you will likely know, Microsoft has recently made public a release date for Windows 10 and has been testing the platform as part of the "Windows Insider" program. With this update comes a number of seemingly unoriginal [1], but nonetheless interesting features, such as "Cortana", Windows' "truly personal" assistant (only to be available in a handful of countries) and "Windows Hello", a biometric authentication system allowing the use of the face, iris, or finger for access [2]. What changes in Windows' security are expected to take place? Will systems such as Windows Hello leak uniquely identifiable biometric data, despite a planned increase in security [3]? What could perhaps be done to limit the risk of using systems such as a cloud-based, personal assistant that is able to access most of a person's internet-connected devices? Thankyou very much, Endless [1] It seems that Windows 10's flagship features such as biometric authentication have already been available on a number of other platforms for quite some time, not to mention the fact that the name "Cortana" was used as the name for an artificial intelligence character in the popular "Halo" game series (The name seems to be have been used without violating intellectual property laws, as Halo, having been originally developed by Bungie, Inc. is now a subsidiary of Microsoft Studios). [2] More information regarding Microsoft's initial announcement of the Windows 10 release date can be found at the following link: https://blogs.windows.com/bloggingwindows/2015/06/01/hello-world-windows-10… [3] A blog post relating to Windows 10's planned "security perks" can be found at the following link: http://blogs.windows.com/business/2014/10/22/windows-10-security-and-identi…

9 11

And it probably fits in a shoe, Max...
by jim bell 23 Sep '15

23 Sep '15

http://www.nextgov.com/cybersecurity/2015/09/dhs-wants-boeing-test-brain-ch… The Department of Homeland Security is funding a Boeing company to create a "brain chip" for its self-destructing Black smartphone that could be adapted for any device, DHS officials say.The technology powering the devices potentially could identify the user’s walking style, for example. Officials would be alerted if the gait does not match the authorized user’s walk – a red flag the phone might have fallen into the wrong hands, officials said. The "secret sauce" of the mobile device is a so-called neuromorphic computer chip that simulates human learning, Vincent Sritapan, the program manager for DHS' mobile device security program, told Nextgov.Gait recognition -- driven by the phone's accelerometer, GPS and the chip -- is but one of many kinds of continuous ID verification intended to tighten access controls on mobile devices. Boeing and HRL Laboratories, a software firm jointly owned by Boeing and General Motors, are partnering under a DHS project worth $2.2 million over 2.5 years. The companies "pretty much are leveraging user behavior information" from data gathered by sensors found on any standard consumer smartphone, Sritapan said. Those feelers could include microphones, cameras and touchpads, he added. The artificial intelligence could help agencies determine, “Are you who you say you are, and do we give you access to enterprise resources like email?” he said.Homeland Security chose the Boeing Black for experimentation, because the company was willing to embed the chip into its device, Sritapan said."I would call this a high-risk, high-reward type of project," he added. "If successful, this technology can go into any device the manufacturers are willing to integrate it with" and would meet military, DHS and other federal agency information security specifications. Referring to the Black as "the test body," he said the government purchased the brand for "specific uses," such as secure voice calls. Smartphone as Test TubeIt remains to be seen whether DHS itself will buy brain chip-embedded Blacks for operations in the field. If the chip is successful at the end of a 2-year research and development period, DHS and Boeing will share the cost of a 6-month pilot program, Sritapan said. State Department staffers apparently plan to or are currently using the Black."Boeing's team will provide a two-consecutive day Discovery Workshop that includes a Boeing Black product overview, technical deep dives and a security requirements analysis," department officials said in a solicitation for a Boeing Black Secure Voice Workshop released Monday. Other players in the military-grade smartphone space include the similarly-named Blackphone made by Silent Circle, an encrypted communications provider co-founded by the inventor of PGP encryption and a former Navy Seal. Android-based Samsung smartphones running the firm’s Knox security software are another option for Pentagon components. Defense Department Chief Information Officer Terry Halvorsen has previously said DOD plans to test top-secret smartphones in the fall. The smartphone AI under development also would continuously track unusual digital transactions, like an app meddling with the operating system or a spike in network traffic, DHS officials said.MIT Technology Review describes the way neuromorphic chips understand the world as basically cognition: "Like the neurons in your own brain, those on HRL’s chip adjust their synaptic connections when exposed to new data. In other words, the chip learns through experience."Their low-power consumption makes the chips especially attractive for smartphones that sap batteries, experts say. Last fall, HRL Laboratories test-piloted a miniature drone with a Defense-funded prototype neuromorphic chip inside. The unmanned aircraft learned to recognize three different rooms it had never entered before by memorizing their wall patterns.A Black-Blackberry Connection?The phone in which the thinking-chip will be tested is straight out of a James Bond movie. The Black completely erases itself if it detects human or technical tampering. It looks like a common, touchscreen Android smartphone, but the hardware and software inside can be custom-tailored to an agency’s or company's specific needs. In the DHS model, the hidden innards will consist of the neuromorphic chip and associated software. Government smartphone stalwart BlackBerry – stepping back from device production – announced last year it will provide software services for Black. BlackBerry this month bought Good Technology, a mobile security software provider widely used in the public sector. Good and BlackBerry combined represented 19 percent of the $1.4 billion mobile management software sector last year. On Tuesday, Boeing officials said in an emailed statement, "Boeing has developed a secure, mobile solution that is designed to meet the needs of defense and security customers. Due to customer sensitivities, we cannot disclose who is currently using the device or considering a purchase."(Image via bestfoto77/ Shutterstock.com)

1 0

Re: FCC NPRM seeks to end open SDR
by wirelesswarrior＠Safe-mail.net 23 Sep '15

23 Sep '15

Rayzer, There are clear and limited definitions, unlikely to be changed, for what legally constitutes a "radio" or a "transmitter". The "mistake" of the SDR manufacturers was to ever call or market them anything but instruments (as Red Pitya has done). When the idea of classifying them as instruments was floated in the early days of the GnuRadio list (by Steve Schear) he cautioned to make sure the products weren't called anything that might even vaguely sound like a wireless device. Evidently the marketing people at these companies knew better. End-user controlled software signal generation and capture techniques are now widely in use by premium instrument manufacturers. If the FCC attempts to curtail the frequencies, modulation types, etc. by these these test instruments I think there will be manufacturers screaming bloody murder. Transmitters are generally much simpler electronically than receivers (which are much less regulated). They may be little more than a few components added to a digital circuit, as Rayzer pointed out, though that rarely leads to a generally useful device. Attaching a circuit which contains the necessary components to generate the desired digital signal (e.g., using a Direct Digital Synthesizer) and convert it to a quality analog one to a USB or on a header of a PC/SoC motherboard should provide a nice signal generator which could effectively bypass FCC enforcement (legally or otherwise). WW

2 1